Once you have completed the examination of a device using MOBILedit Forensic, we recommend following these steps to preserve the acquired evidence, document the examination and, where appropriate, restore the device to its original state.
1. Save the acquired data
Before disconnecting the device, ensure that all required data has been successfully acquired and saved.
Where supported, we recommend creating and securely storing an encrypted physical image (ULTRA) or an "All data" MOBILedit backup (PRO).
This allows you to perform further analysis without needing to retrieve and reconnect the original device. Depending on the acquisition method and available data, you can continue examining the saved image or backup.
Verify the integrity of the acquired data and retain the relevant examination reports, logs and acquisition details.
2. Remove the MOBILedit Connector application
If the MOBILedit Connector application was installed on the device during the examination, uninstall it when it is no longer required, provided that doing so is appropriate for the investigation.
3. Restore modified device settings
During the acquisition process, certain device settings may have been changed to enable communication or facilitate data extraction.
Where appropriate, restore these settings to their original state, including:
-
Developer options
-
USB debugging
-
Stay awake
-
Any other settings or permissions modified during the examination
Ensure that any changes made to the device are documented. Avoid unnecessary modifications that could affect the integrity of potential evidence.
4. Consider examination traces
Some acquisition methods require the installation of applications, agents or APK files, or the activation of debugging features.
The use of such methods is an accepted part of mobile forensic examinations, provided that the actions are justified and appropriately documented.
In certain circumstances, particularly covert examinations, minimising examination traces may be operationally necessary. Additional steps, such as clearing Android debugging logs, may be considered where authorised and appropriate.
Important: Removing applications or clearing logs can itself modify device data or eliminate potentially relevant information and does not guarantee that all examination traces have been removed. Evidence preservation should take priority during standard forensic examinations.
5. Document the examination and device condition
Before returning, storing or transferring the device:
-
Record the examination activities and any changes made to the device.
-
Document any errors, unexpected behaviour or issues encountered.
-
Record any damage identified before, during or after the examination.
-
Ensure that the acquired data and associated reports are securely stored.
-
Maintain the chain of custody and record any transfer of the device or evidence.
6. Secure the device
Once the examination is complete, disconnect and secure the device in accordance with your organisation's evidence-handling procedures.
Consider whether the device should remain powered on, be switched off or be isolated from networks, taking into account the device's encryption state, potential remote access and any requirement for further examination.
Note: The appropriate post-examination procedure will depend on the device, acquisition method, investigation requirements and applicable forensic policies. Evidence preservation should always take priority over restoring settings or removing examination traces.