The misfits that I beg you not to overlook.
The smartphone components that, if you
have done mobile forensics for a long time, you think about,
you plugged in a Nokia device to a UFED,
it acquired the SIM card, it acquired the SD card.
That is not always the case.
Best practices are for you to assume the SD card and SIM
card were not acquired during acquisition.
If you do that, you don't have to wonder, did my tool get it?
Don't trust that your tool got it, and do it yourself.
It will not take a long time for you to extract that SIM card--
maybe a minute to three minutes--
and acquire it yourself.
If you're extracting SD cards, make
sure you write-protect them.
This is so important.
And I'm going to say this several times.
If you do not write-protect that SD card,
your forensic workstation is going
to reach out and touch it, leave traces behind.
If you do write-protect it, you will preserve last accessed
date time stamps that the phone will actually change--
or could change-- during acquisition.
If you think about this, if you have your phone in front of you
and you're scrolling through and you're
looking at things that exist on an SD card from that Android,
the phone is touching it, which means it's
updating last accessed times.
If your forensic tool is pulling data through that phone,
it's changing last accessed.
So the most forensically sound way to handle this
is to right protect that SD card,
remove it, and acquire it.
Now, where I want you to really tread cautiously,
I recommend you acquire that phone
as it arrived in your hands, meaning, if I have it
and it's powered on, I acquire it as is.
Because if you remove that SIM card,
if you remove the SD card, you could actually
remove the biometric lock.
Meaning, if I can look at my phone
and unlock it with my face or unlock it with my finger,
the password is stored in memory.
That phone is actually in a better state
that you can get the most information from that device.
So do not remove components, unless it's turned off,
before you attempt acquisition.
It's very, very important.
You may only get one shot.
You may not know you missed something until it's too late.
So please consider this when you're doing
acquisition of these devices.