Which of the following best describes the initial processing phase used in mobile device forensics?

Which of the following best describes the initial processing phase used in mobile device
forensics?
A. The phone should be powered down and the battery removed to preserve the state of
data on any internal or removable storage utilized by the mobile device
B. The removable data storage cards should be processed first to prevent data alteration
when examining the mobile device
C. The mobile device should be examined first, then removable storage and lastly the
phone without removable storage should be examined again
D. The phone and storage cards should be examined as a complete unit after examining
the removable storage cards separately.
Answer: D

Leave a Reply

Your email address will not be published. Required fields are marked *