Examination and analysis

This is the ultimate step of the investigation, and it aims to uncover data that is present on the device. Examination is done by applying well-tested and scientific methods to conclusively establish results. The analysis phase is focused on separating relevant data from the rest and probing for data that is of value to the underlying case. The examination process starts with a copy of the evidence acquired using some of the techniques described previously, which will be covered in detail in coming chapters. Examination and analysis using third-party tools is generally performed by importing the device's memory dump into a mobile forensics tool that will automatically retrieve the results. Understanding the case is also crucial to performing a targeted analysis of the data. For example, a case about child pornography may require focusing on all of...