Acquisition is the process of getting evidence off a device in a way that can be relied on later. It sounds simple. It is where most cases are won or lost, because the decisions made at acquisition determine what is available for analysis, and what is admissible in court.
What acquisition includes
- Documenting the state of the device on arrival.
- Isolating it from the network to prevent remote wipe or change.
- Selecting a method matched to the device and the case.
- Producing a hash verified image, with the working copy kept separate from the master.
What goes wrong
Devices are handed over already unlocked and browsed. Working copies are taken from working copies, so hashes cannot be tied back to the original. Acquisition is performed on the live device rather than on an image. Any of these failings is enough to unpick the evidence in cross examination.