## 1 Introduction
It is noteworthy that such files and devices can be part of the investigation of most crimes in the digital environment. Therefore, they must be adequately investigated and protected against alteration, maintaining protection under the chain of custody. The Mobile Device Forensics is characterized by difficulties in accessing device data, the effort to unlock or bypass security mechanisms and obtain data, and often, by the inability to obtain the entire volume of data contained in the device. One is also feature by the fact that it is more complex than traditional computer forensics, requiring better-trained teams and specialized equipment to obtain legally acceptable results. Unlike traditional Forensic Computing, where any intervention in the system must be avoided at all costs, in forensics on mobile devices it is necessary to perform access and make interventions directly on the hardware for possible attempts to bypass the access block mechanisms, and also install elevation of privilege applications. However, the correct use of techniques allows to preserve the evidence, and consequently, the legitimacy of the obtained evidence. Figure 1 represents, in a summarized way, the steps of a methodology that can be applied to mobile forensics. With regard to mobile device forensics, the scenario for obtaining evidence may also be different. We will briefly address each of the steps of the methodology, always aiming at obtaining the legality of the actions. 1. _Evidence identification_: As it is a mobile device, its identification may be more difficult, as the offender tries to hand over another device in place of the one who actually has the evidence. Therefore, it is essential to determine which fact needs to be clarified and which devices should be analyzed. It is important to record all details of the location and the seized items. 2. _Preservation of evidence_: The device to be analyzed must always be handled with gloves so that the fingerprints of the device user are preserved. Although it is not part of the acquisition and analysis of digital evidence, such evidence may be relevant to other forensic sciences. The device should be kept, whenever possible, in the state in which it was seized. If it is seized turned-off, it must remain off. Otherwise, it is also important to put the device in airplane mode, to prevent it from receiving new calls, SMS, creating new itinerary records by GPS, avoiding false positives during the analysis process, or even, that the data may be erased remotely. If this is not possible, a faraday bag must be used to transport the device to the laboratory where the data will be acquired. All features of the device must be documented. 3. _Chain of custody_: Chain of custody, in the legal context, refers to the chronological or historical register that records the sequence of custody, control, transfer, analysis, and disposition of evidence, whether physical or electronic, and is of fundamental importance in criminal cases. 4. _Method for acquiring evidence_: The forensic analyst should evaluate the best tool or methodology for data acquisition, preferably using the least invasive methods, and it may be used these according to the need. 5. _Investigating questions_: The authority responsible for elucidating the case must formulate the questions for which the forensic analyst must search the evidence for answers that satisfy the authority's questions. 6. _Analysis process_: These are the processes, tools or methodologies through which the acquired evidence will be analyzed to answer the investigative questions. 7. _Conclusive report_: It is the document that includes all the records made in the previous steps, and mainly, answers the investigative questions asked by the competent authority. It has become common to find public reports showing that the use of smartphones in the practice of illegal acts is growing. Increasingly, these devices are used to practice criminal activities, becoming digital evidence, relevant for criminal investigations.