When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes even when the device is simply powered on. It is best practice to: Mobile devices are constantly changing when powered on, and there is no way to write block a mobile device because they communicate using modern protocols such as AT commands and others. Because of these factors, the goal in forensic becomes to make as little change as possible, and to document those changes that were made to the device during the forensic process.
Question:
When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes even when the device is simply powered on. It is best practice to:
Options:
Only acquire from devices in an OFF state
Document those changes that were made to the device during the forensic process
Always use a write-blocker when dealing with mobile devices
Always remove the battery from a device before acquisition
Correct Answer
The Correct Answer for this Question is
Document those changes that were made to the device during the forensic process