Mobile DFIR (Forensics & Incident Response)

Forensics optimises for defensible, repeatable evidence: keep the device untouched, isolate it and image it. Incident response optimises for speed and containment: isolate the network, kill live sessions and collect volatile data, which changes the device. The same analyst switches consciously between the two modes and documents which one they are in.

A connected device can receive a remote wipe command or be manipulated remotely, destroying evidence. The first physical action at most scenes is radio isolation using airplane mode, a Faraday bag or a shielded room. You record the exact time you isolated it, then proceed with acquisition.

The chain of custody is the documented record of who handled the evidence, when, and what they did to it, maintained under every step from seizure to report. If the chain breaks, the evidence can be challenged no matter how good the analysis was, which is why it runs beneath the entire workflow.

Inside app SQLite databases, plists and SharedPreferences rather than in files you can simply open. Messaging apps, browsers and system services keep their state in SQLite. You hash and copy the store, open the copy read-only, and remember to capture the write-ahead log so recent records are not lost.

Volatile data first: memory contents, running process state and active sessions, because they vanish on reboot and can lock encryption keys away. On-disk databases and cloud backups are far more durable and can be collected afterwards, so collection order follows how quickly each type disappears.