ABSTRACT
Computers have been designed for lengthy service, and the internal memory is replaceable. The provision for an exchangeable hard disk drive or solid-state drive within the computer chassis provides the ability to follow a reliable and consistent forensic process. An immediate difference noted between personal computer and mobile device forensics comes in the form of how the user-generated data is stored. The presence of databases within the Apps requires the forensic examiner to have capability in database interrogation. Mobile device forensics is more akin to having a very good neighborhood vehicle repair shop versus an auto dealership service center. The process used during the seizure of the mobile device can make or break the results of the examination. In consideration, to function as designed, a mobile device is to be in a constant state of connection; whether cellular based or network based.
