Saturday, November 04, 2006

Mobile Telephone Evidence - Handset examination

Handset examination

For those who have not as yet considered the examination procedure for video-phones or mobiles that have no forensic data acquisition programs, perhaps the following observations may be of use.

1. Video the examination
2. Ensure video has date/timestamp and other traceable signatures
3. Keep the Master copy safe
4. Make Working copies from Master copy (see 7,8)
5. During examination, make sure examiner seen make contemporary notes
6. Ensure examiner seen referring to 3 handset user manual
7. Working copy: take Stills needed for evidence (inc date/timestamp etc)
8. Working copy: for defence

More info on Trew MTE mobile 'phone forensic training courses: trewmte@googlemail.com