Environmental documentation: When assessing evidence in any judicial institution, preparing documents as required is one of the most important tasks. First of all, photographs of the mobile device itself and the environment (especially cables, adapters, docking station, etc.) should be taken. Also note the status of the device (operating / not operating; locked / unlocked; visible damage, etc.) in the documentation.
IMEI documentation: As an identifier for smartphones, the documents usually use the IMEI (International Mobile Station Equipment ID). Because IMEI needs to identify a device in the cellular network, dual SIM phones have two IMEIs, and phones made for the CDMA network have MEIDs instead of IMEIs. Tablets that are not capable of binding to a cellular network do not have an assigned IMEI.
Usually the IMEI is printed on the back of the phone or on a label on the bottom of the battery. If you cannot find an IMEI this way, you can usually find it in the phone’s menu or by pressing * # 06.
Using Locked Mobile Devices: If the phone is unlocked, the first priority is to stop the phone from locking, touch the screen, and set the screen timeout setting to the maximum. The next step is to go to the security settings and check if any lock code is set. If the lock code is available and the code is unknown, it is conceivable that the data extraction from the phone be performed immediately at the scene.
If the display is not active when the device is found, the display should not be touched; thus, possible stains on the screen can be removed and solved by possible unlock patterns of the phone.
All modern smartphones have the option of locking the phone with the remote control command or deleting all data on the phone. This imposes the risk of losing all evidence of a device. In addition, data received after the seizure may alter or overwrite evidence and undermine the forensic soundness of your examination. Therefore, the next priority should be to disconnect the device from