Preserving the data extracted from a mobile phone is an important part of the overall process. It is also important that the data is retained in a usable format for the ongoing court process, for future reference, should the current evidence file become corrupt, and for record-keeping requirements. Court cases may continue for many years before a final judgment is arrived at, and most jurisdictions require that data be retained for long periods of time for the purposes of appeals. As the field and methods advance, new methods for pulling data out of a raw, physical image may surface, and then you can revisit the data by pulling a copy from the archives.

Now that we have understood how the evidence extraction process works, we will be looking into the different approaches in practical mobile forensics.