D3 Mobile Forensics
Credentials and evidence transfer
Agree the route before transmitting material.
Initial contact
Do not send evidence, device passwords, account passwords, MFA codes, recovery keys, wallet seed phrases or sensitive case documents through the intake checklist, ordinary email, WhatsApp or Signal. Initial contact does not create legal professional privilege or establish acceptance of instructions.
Authority before access
Work proceeds only after documented authority, scope and the applicable legal basis are established. Possession or ownership of a device does not itself authorise access to every account, employee communication or third-party record. Cloud jurisdiction, provider terms and proportionality must be assessed separately.
Case-specific transfer plan
Before collection, agree the approved transfer channel, intended recipients, source identifiers, encryption, integrity checks, custody record and acknowledgement of receipt. Send encryption secrets through a separate agreed channel. Do not modify or restore the original device to prepare a transfer without examiner advice.
Authentication
Where required, the account holder should normally complete MFA during an agreed session. Establish the precise permission and duration of any temporary access. Record and later revoke temporary sessions or credentials where appropriate. Do not provide a wallet seed phrase merely because a device or wallet is being examined.
Account effects and closure
Cloud or linked-device collection can trigger alerts, create sessions or change account state. Authorise these effects separately and document them. At closure, agree return, retention, deletion and any continuing preservation duties; do not delete evidence while a hold or obligation remains.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
