page_title: Mobile device forensics
section_title: Acquisition
hierarchical_section_title: Mobile device forensics / Forensic process / Acquisition
caption_attribution_description: An RF shield bag with an iPhone in it.
context_page_description: Mobile device forensics is a branch of digital forensics relating to recovery of digital evidence or data from a mobile device under forensically sound conditions. The phrase mobile device usually refers to mobile phones; however, it can also relate to any digital device that has both internal memory and communication ability, including PDA devices, GPS devices and tablet computers.
  The use of mobile phones/devices in crime was widely recognised for some years, but the forensic study of mobile devices is a relatively new field, dating from the late 1990s and early 2000s. A proliferation of phones and other digital devices on the consumer market caused a demand for forensic examination of the devices, which could not be met by existing computer forensics techniques.
  Mobile devices can be used to save several types of personal information such as contacts, photos, calendars and notes, SMS and MMS messages. Smartphones may additionally contain video, email, web browsing information, location information, and social networking messages and contacts.
  There is growing need for mobile forensics due to several reasons and some of the prominent reasons are:
context_section_description: The second step in the forensic process is acquisition, in this case usually referring to retrieval of material from a device (as compared to the bit-copy imaging used in computer forensics).
  Due to the proprietary nature of mobiles it is often not possible to acquire data with it powered down; most mobile device acquisition is performed live. With more advanced smartphones using advanced memory management, connecting it to a recharger and putting it into a faraday cage may not be good practice. The mobile device would recognize the network disconnection and therefore it would change its status information that can trigger the memory manager to write data.
  Most acquisition tools for mobile devices are commercial in nature and consist of a hardware and software component, often automated.
caption: iPhone in an RF shield bag
exif: {"Image Make": "Canon", "Image Model": "Canon EOS 400D DIGITAL", "Image Orientation": "Horizontal (normal)", "Image XResolution": "72", "Image YResolution": "72", "Image ResolutionUnit": "Pixels/Inch", "Image DateTime": "2010:10:14 10:47:48", "Image YCbCrPositioning": "Co-sited", "Image ExifOffset": "196", "Thumbnail Compression": "JPEG (old-style)", "Thumbnail XResolution": "72", "Thumbnail YResolution": "72", "Thumbnail ResolutionUnit": "Pixels/Inch", "Thumbnail JPEGInterchangeFormat": "6132", "Thumbnail JPEGInterchangeFormatLength": "7907", "EXIF ExposureTime": "1/25", "EXIF FNumber": "4", "EXIF ExposureProgram": "Program Action", "EXIF ISOSpeedRatings": "400", "EXIF ExifVersion": "0221", "EXIF DateTimeOriginal": "2010:10:14 10:47:48", "EXIF DateTimeDigitized": "2010:10:14 10:47:48", "EXIF ComponentsConfiguration": "YCbCr", "EXIF ShutterSpeedValue": "76085/16384", "EXIF ApertureValue": "4", "EXIF ExposureBiasValue": "0", "EXIF MeteringMode": "Pattern", "EXIF Flash": "Flash did not fire, compulsory flash mode", "EXIF FocalLength": "27", "EXIF FlashPixVersion": "0100", "EXIF ColorSpace": "sRGB", "EXIF ExifImageWidth": "1936", "EXIF ExifImageLength": "1288", "Interoperability InteroperabilityIndex": "R98", "Interoperability InteroperabilityVersion": "[48, 49, 48, 48]", "EXIF InteroperabilityOffset": "5766", "EXIF FocalPlaneXResolution": "1936000/877", "EXIF FocalPlaneYResolution": "644000/291", "EXIF FocalPlaneResolutionUnit": "2", "EXIF CustomRendered": "Normal", "EXIF ExposureMode": "Auto Exposure", "EXIF WhiteBalance": "Auto", "EXIF SceneCaptureType": "Standard"}