Mobile Device and Other Non-Traditional Media Forensics
Mobile Device and Other Non-Traditional Media Forensics
This domain tests mobile acquisition states, cloud and carrier evidence, and newer media such as IoT, drones, and vehicles. The examiner must match the acquisition method to the lock state and authority.
Core rules
- Mobile acquisitions include logical, file-system, physical, backup, JTAG, and chip-off. iOS and Android encryption and lock state determine what is possible.
- AFU (After First Unlock) and BFU (Before First Unlock) states change key availability. A BFU device may yield little without a passcode or cloud backup.
- Preserve power and lock state; use a Faraday bag; avoid unnecessary interaction. Document any change.
- SIM data includes ICCID, IMSI, SMS, and contacts. Carrier CDRs show call and data events, not content.
- Cloud backups and app sync may hold evidence not present on the device. Other media include drones, vehicle infotainment/telematics, wearables, gaming consoles, and smart-home devices.
Worked example
An iPhone is BFU and locked. Logical extraction is not possible. The examiner documents the state, seeks authority for the iCloud backup and carrier records, and avoids unauthorized brute force. The report distinguishes what the device yielded from what cloud and carrier records provided.
Traps
Assuming logical extraction recovers deleted data; ignoring cloud and carrier sources; powering on a seized phone; failing to document passcode and lock state; treating CDRs as content.
Key points
- Lock state determines feasible mobile acquisition.
- AFU and BFU affect key availability.
- Preserve power, passcode state, and network isolation.
- Cloud backups may hold evidence absent from the device.
- CDRs show events, not communication content.