Now that we talked about hot and cold,
does your lab have methodologies for smartphones and collection?
There's two ways to do this.
You could say always on, always off.
I have worked in one lab ever where
we had strict requirements regardless.
And this is because we were supporting military operations,
where a lot of these phones were used to detonate IEDs.
So instead of the phone exploding or causing
something to explode, we taught them every single time,
we don't care about encryption.
Power the phone off.
Remove the SIM card.
Remove the SD card.
And if you can remove the battery, do that to.
Just to protect the soldiers who were handling these devices.
Now, if that is not the case, this
is where you have to think about it.
It is rare for you to always do the same thing.
Are you always going to turn it off
or are you always going to leave it on?
Typically, this depends on when are you going to acquire it
or what state the phone is in.
It could also depend on your investigation.
So if we're working an active shooter investigation,
we probably want to acquire that as quickly as possible.
If we are working a cold case homicide
and the phone's been powered off for two years,
the phone's powered off.
You have to just think about your scenario, your lab,
and time to evidence.
When are you actually going to be able to extract that device?