thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Mobile Device Forensics

Acquiring and analyzing data from smartphones and tablets, such as messages, location history and app data.

Definition

Acquisition types include manual, logical, file system and physical extraction, with tools like Cellebrite and Magnet AXIOM. Devices should be isolated from networks, using a Faraday bag or airplane mode, to prevent remote wipe. Encryption and locked devices complicate acquisition.

Example

Placing a seized phone in a Faraday bag to block a remote wipe command before extraction.

Exam tip

Faraday bag isolation is the expected first step for seized mobile devices.

Related terms