Working with the Digital Forensics Unit
The handover that lets the DFU triage faster: the right metadata, the right artefacts and the right context.
Quick Answer
The MG11 / examination request needs: device make/model, power state at seizure, observed lock state, known PINs/passwords (if voluntarily provided), associated accounts and a clear scope of examination.
What the DFU Needs From You
The MG11 / examination request needs: device make/model, power state at seizure, observed lock state, known PINs/passwords (if voluntarily provided), associated accounts and a clear scope of examination.
Volatile vs Non-Volatile
If the device was on at seizure and contains volatile data of interest (RAM, running apps), flag it explicitly. The DFU may image differently to preserve this state.
Triage Priorities
Triage scope should be proportionate: not every case requires a full physical extraction. Be explicit about the offence, the data classes of interest and the timeline.
Maintaining Isolation in the Lab
Once at the DFU, devices remain in shielded storage until placed in a Faraday workstation or examination tent. Isolation is end-to-end, not just point-of-seizure.
Ask About This Article
Andover Forensics Assistant
Typically replies in a few seconds