The mobile phone evidence extraction process

Evidence extraction and the forensic examination of different mobile devices may differ based on various factors. However, following a consistent examination process will help the forensic examiner to ensure that the evidence gathered from each phone is well documented and that the results are reliable. There is no well-established standard process for mobile forensics.

However, the following diagram provides an overview of process considerations for the extraction of evidence from mobile devices. All methods used when extracting data from mobile devices should be tested, validated, and well documented:

As shown in the preceding diagram, forensics on a mobile device includes several phases, from the evidence intake phase to the archiving phase. The following sections provide an overview of various considerations across all the phases.