SD cards.
These are the most compact data storage we have on devices.
You will find that many Androids have restrictions
on how much space of an SD card it will actually leverage.
Let's say you have a 1-terabyte SD card.
The Android may only mount 256 gigabytes and leverage it.
However, the user could easily take that SD card out, plug it
into their Mac or their PC, and store anything they want on it.
That's what I mean by transient devices.
I could have all of my text documents.
I could have photos that exist on an SD card
that the phone never even acknowledges.
Keep that in mind.
The data that is stored here-- again,
if it's acquired through the phone,
it may change last accessed time stamps.
So the best method is going to be to acquire the device as is.
But if you care about last accessed time stamps on that SD
card, remove it, write-protect it, and acquire it
outside of the device first.
If you have time, I recommend doing it both ways--
inside the device and outside.
Preference would be to outside if you
need to preserve last accessed timestamps.
Very, very important.
Now, let's say you get a device, and you're looking--
maybe you didn't do the acquisition.
It just arrived to your lab.
And you look at it, and you're like, why
did the person look at all of these photos on the state?
Maybe they didn't.
Compare that timestamp to the acquisition timestamp.
And what I just said occurred.
The time stamps on an SD card came through to the device,
and last accessed time stamps were changed.