Forensic investigators should routinely determine if backup files exist during their initial case assessment. A backup file is a like a snapshot of the devices memory in time. It is an excellent alternative to a lost or locked device or when other forensic procedures cannot recover the data. A backup may be found in the cloud or may be stored on a computer or mobile device. It would require the user’s credentials or a forensic acquisition of the device it was stored in. Attempts to restore a backup without the proper training could result in the contamination and permanent loss of data. A backup file is also a good alternative when faced with a locked device with an unknown pass code. However, advances in technology allow examiners to overcome more locked devices than ever before. Because of the rapid pace of technology, the forensic community lags behind. New tools are created regularly so reviewing the latest forensic capabilities periodically is recommended. Damaged devices can often be accessed after making only minor repairs, more often than not. For example, the simple and inexpensive process of replacing a broken screen may be the only thing preventing the examiner from accessing the device. Water damage can also be easily mitigated, but requires the investigator to follow a recently updated standard procedure. Depending on the device and the current state of the devices power certain actions should be taken. See the iPhone Collection Flowchart and the Android Collection Flowchart.
Modern mobile devices such as smart phones, tablets and portable navigation devices can contain a history of a user’s location for many months and sometimes many years depending on the device characteristics. The location data stored in the device memory can originate from many sources with the most common being Global Positioning System (GPS) information. The Global Positioning System (GPS) uses satellites orbiting the earth to determine the location of a GPS enabled device. GPS is more accurate than other sources of location data, and this data can be plotted on a map including date and time. The GPS data could reside in many different types of data. The GPS location information could be contained in the metadata of a photo or video, from the use of an installed third-party application, and from web browsing or a mapping program. So if you have access to the device it’s easy to forensically image and triage it to look for location data, user settings, installed applications and metadata fields. For more information IRIS LLC Toolbox-Location Data