Abstract

Acquisition, decoding, and presentation of information from mobile devices are complex and challenging. Device memory is usually integrated into the device, making isolation prior to recovery difficult. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation. A variety of tools and methods have been developed (both commercially and in the open-source community) to assist mobile forensics investigators. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent. The article analyzes the features of the appointment of a forensic computer-technical examination, also addresses the issues of the appointment of a comprehensive and additional computer-technical examination. The errors arising at the appointment of the examination are considered.