D3 Mobile Forensics
Acquisition feasibility and device state
The same model can produce different evidence depending on its current condition.
Unlocked
An unlocked device may permit logical, backup or supported deeper collection, but sandboxing and app encryption still restrict access. A passcode is not proof that every record is recoverable.
Locked AFU and BFU
After First Unlock describes a device that has been unlocked since restart; some relevant key material may remain available, depending on platform and state. Before First Unlock follows restart before that first unlock and commonly exposes less decrypted material. Neither state guarantees an acquisition. Record the state; do not restart merely to test it.
Disabled or damaged
A disabled device is not necessarily erased. Repeated guesses or a restore can worsen prospects. For physical damage, assess power, storage, connectors and encryption before repair or acquisition. Hardware work requires a separately justified plan.
Rooted, jailbroken or modified
Existing privilege changes may alter available acquisition routes and evidential reliability. Installing new software or changing privileges can modify evidence; capability does not make intervention automatically proportionate.
Reset or reused
A modern encrypted reset commonly removes access to prior keys. Reuse does not reconstruct them. Assess pre-reset backups, existing linked clients, account data and counterpart devices independently.
Feasibility inputs
Record make, exact model, chipset if known, OS and patch version, application version, power/lock state, relevant dates, reset history and available backups. Do not send secrets. Distinguish an inaccessible source from a source acquired successfully with no relevant records.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
