EXTRACTION INTAKE PHASE

The extraction intake phase involves the procedure by which requests for extractions are handled. The extraction intake phase entails request forms (website) and intake paperwork to document chain of custody, ownership information, and outlines general information regarding the type of data the requester is seeking to have extracted or documented from the phone.

 IDENTIFICATION PHASE

For every extraction, the examiner identifies the following:

·        The legal authority to examine the phone

·        The goals of the extraction

·        The make, model and identifying information 

 PREPARATION PHASE

Within the Identification phase of the process, the examiner has already engaged in significant preparation for the extraction of the phone. However, the preparation phase involves specific research regarding the particular phone to be extracted, the appropriate tools to be used during the extraction and preparation of the extraction machine to ensure that all of the necessary equipment, cables, software and drivers are in place for the extraction.

 ISOLATION PHASE

Cellular phones are by design intended to communicate via cellular phone networks. They are also sometimes capable of connecting to each other and to other networks via Bluetooth, infrared and wireless (WiFi) network capabilities. For this reason, isolation of the phone from these communication sources is important prior to examination. Isolation of the phone prevents the addition of new data to the phone through incoming calls and text messages as well as the potential destruction of data through a kill signal or accidental overwriting of existing data as new calls and text messages come in.

We utilize the use of a Faraday bag for the isolation of a cellular phone in the field which are specifically designed for this purpose.

PROCESSING PHASE

Once the phone has been isolated from the cell phone and other communication networks, the actual processing of the phone may begin. The appropriate tools to achieve the goal of the extraction have been identified in the steps described previously, and they can now ideally be used to extract the desired data from the phone.

 VERIFICATION PHASE

After processing the phone, the examiner engages in verification of the accuracy of the data extracted from the phone and record it.

DOCUMENTATION & REPORTING PHASE

Documentation of the extraction occurs throughout the process in the form of contemporaneous notes regarding what was done during the extraction. Extraction worksheets can be helpful in the extraction process to ensure that basic information is recorded.   The examiner’s notes and documentation should include information such as:

• The date and time the extraction was started
• The physical condition of the phone
• Pictures of the phone and individual components and the label with identifying information
• The status of the phone when received (off or on) Make ,model, and identifying information
• Tools that were used during the extraction
• What data was documented during the extraction
  

PRESENTATION PHASE

Consideration should be given throughout the extraction as to how the information extracted and documented can clearly be presented to a client, investigator, prosecutor and to a court. In many cases, the receiver may prefer to have the extracted data in both paper and electronic format so that call history or other data can be sorted or imported into other software for further analysis.

ARCHIVING PHASE

Preservation of the data extracted and documented from the cellular phone is an important part of the overall process. It is necessary to retain the data in a useable format for the ongoing court process, future reference, and for record keeping requirements. Some cases may endure for many years before a final resolution, and most jurisdictions require that data be retained for varying lengths of time for the purposes of appeals.