Whether backup encryption was previously enabled on the mobile device or enabled
as part of the acquisition workflow, the password will need to be noted, as it will be
required to access the backup file contents in the upstream forensic investigation
software tool.
Note: Mobile device backup files can be encrypted (via a setting on the device),
which typically results in more user data being included in the backup file,
which is forensically desirable. However, the files included in an encrypted
backup will typically have different encrypted data from job to job (with the
exact same source file data), which makes the encrypted backup file hashes
inconsistent between subsequent backup acquisition jobs on the same source
device. Keep this in mind as you use mobile backup encryption in your digital
forensic investigations.
Eject
It is highly recommended to eject all media devices before removing them from TX1.
To eject a mobile device, tap the mobile device tile from the Sources list and the
mobile device details screen will appear with the media utilities at the bottom. Tap
Eject and then confirm the dialog prompt to complete the ejection process. The
device may then be physically removed from TX1.
4.9.4 Performing a mobile backup acquisition
To perform a mobile backup acquisition:
1. Using commercially available adapter cables, attach the mobile device to TX1’s
USB source port. For the destination, attach a formatted drive to one of the TX1
destination ports or mount an available iSCSI drive or CIFS/SMB share on your
network.
Note: Multiple mobile backup acquisition jobs can be run simultaneously,
although a USB hub will be needed to provide the required number of USB
source ports. Unlike other TX1 job types, only a single destination can be
used with a mobile backup acquisition job. Multiple mobile backup jobs
can use a single destination.
2. From the Home screen, tap the Mobile icon. The Mobile job setup screen is
displayed.
4.9. Mobile backup acquisition
ISTX240300-UGD-EN-1
User Guide
155
To Next Page
Loading...
