As an experienced employee of the DigiFirm Investigation Company, there are various key steps that I must take in securing forensic evidence from my device, herein the IPhone 7 plus. These steps and retrievable information are as discussed below:
Steps involved in seizing evidence
The first step is turning off the seized device and the removal of its battery. By so doing, such information as the cell tower location, and call logs are preserved in addition to preventing any possibility of remote tampering. In case the situation does not favor turning off the mobile device, the best course of action would be securing it in a Faraday bag to isolate its cell tower. Alternatively, the device will be put on airplane mode with the consequent disabling of both the Bluetooth and the WI-FI. Any plastic bags must be avoided to prevent a build-up of humidity or condensation. Thereafter, all required information is retrieved and sent to a forensic laboratory for further analysis (Doherty, 2016).
In the laboratory, a work copy or image of the original device must be made and stored under pristine conditions. Thereafter, there is the isolation of wireless devices to ward off any unwanted connections, the installation of a write-blocking software, selection of the most appropriate extraction method, and submitting the mobile device for the traditional examination of evidence. Based on the retrieved evidence, investigations are then carried out. To retrieve information from the device, various methods are applicable including manual operation utilizing the user interface, logical or physical acquisition utilizing the communication port, or physical acquisition using JTAG or access via a memory chip (Hoog, & Strzempka, 2011).
Information retrievable from device about the owner
For any mobile device to be used by a forensic expert in gathering evidence, such an expert must establish what areas of interest to look into. Ideally, the most common sections include any emails sent via the mobile device, instant messages and text messages, documents stored within the device, browsing history, images, as well as any transactions or records of transactions. Even if erased, this information is still retrievable from the cloud, an online-based system of backup utilized by such devices (Doherty, 2016).
Mobile devices can also give various information about the user. For instance, using the device, it is easy to establish the movement patterns of the owner by tracking the cell locations. This is particularly made easier in instances where the photos are geo-tagged such as on social media platforms as Facebook or in instances where the GPS was enabled on the device (Hoog, & Strzempka, 2011).
IPhone 7 plus properties
-Features a 32GB or a 128 GB capacity
-weighs 6.63 ounces
-5.5 inches LCD display featuring IPS technology
-1920-by-1080 megapixels resolution
-M10 motion co-processor
-Built-in rechargeable lithium-ion batteries
-iOS 11 operating system