As a preliminary step in the process, Sheriff Jamison asks you to discuss an investigation plan identifying how you, as the digital forensics investigator, can assist with the case by examining the missing girl's iPhone for footprints, and by providing a description of the considerations and mobile investigative challenges associated with mobile forensics and mobile platforms, including third party applications, security measures, communication interfaces, and sensors. As a reporting technique, this plan should include the following:
- Where mobile phone data may be extracted from
- What types of mobile phone data might be present
- How mobile phone data can be retrieved from an iPhone
- How the data will be forensically preserved and analyzed
- Mobile phone applications that may hold useful information to this case
- How the evidence will be handled in anticipation of court admissibility
Based on your experience and expertise, you know to include deep diving to locate deleted and locked data and timelines, as well as geographic information systems and Bring Your Own Device. As you prepare to scan for tools to use in this investigation, you outline the need to look at the phone (SIM/USIM), and any additional memory (SD/memory cards), for Call Logs, Text and SMS Messages, Call Logs, Text and Sms Messages, Contacts, Graphics, Web History, Location Information, Wi-Fi Connections call logs, text and SMS messages, contacts, graphics, web history, location information, Wi-Fi connections and application data. The goal of this plan is to summarize the current landscape with mobile phone forensics and mobile incident response and investigation, the guidelines for how examiners approach mobile phone evidence, the challenges posed by iPhones, limitations and constraints, and the expectations for forensic analysis of this device.
Construct an investigation plan that addresses the concerns listed above.