Forensic Acquisition Methods

Question 1

Physical Acq. via device interaction

Answer 1

Acquires all data on device, producing a binary file to be decoded for analysis

Question 2

JTAG

Answer 2

Using the JTAG interface on the devices ECB, acquires binary file to be decoded

Question 3

Manual Scroll

Answer 3

Physically using the device and interacting with the device for surface level analysis

Question 4

Logical Acquisition

Answer 4

Only acquires active data on device that the OS allows

Question 5

File system Acquisition

Answer 5

Allows access to full file system on the device, may recover deleted/hidden files on the device

Question 6

Physical Acquisition

Answer 6

acquires all non-volatile data, binary file dump containing unallocated areas and deleted files

Question 7

Proprietary Bootloader

Answer 7

a custom bootloader can be
injected into the handsets RAM to prevent the operating system from launching as normal, can then be instructed to execute custom operations.

forensic tools can use the bootloader to access the non-volatile memory on a mobile
device allowing for no permanent changes