Sandline Global now offers clients the benefits of advanced mobile device extractions. Using best of breed tools and methodologies, more data can be extracted now from mobile devices, including deleted data (recovery of data is not guaranteed), and more information about how a user had interacted with the device. Additionally, where supported, targeted collections of data types can be performed, including for example, chats from a specific app.
This solution relies on specialized hardware, and therefore, the data collection can only be performed onsite or in-lab; remote data collections are not possible for advanced mobile device extractions.
To perform an onsite data collection, Sandline Global’s team would travel to the location where the physical device is located. The time it takes to perform a data collection, depends on several factors, including the type of data collection required, and the storage capacity of the device. Depending on the location, travel time and expenses may apply.
Alternatively, the device may be shipped or couriered to Sandline Global’s digital forensic laboratory in New York City. The advanced mobile device extraction would be subsequently performed. Once complete, the device would be sent back to the data custodian or coordinating party. The turnaround time for in-lab data collections is typically 1-business day. Based on delivery options, it is likely that the data custodian would be without the device for 1 to 3 days. Sandline Global recommends using a multinational shipping provider, with tracking information.
As part of the data collection process, Sandline initiates chain of custody documentation. Depending on the security settings of the mobile device, it may be necessary to provide Sandline with the device passcode and the iTunes backup password (for Apple mobile devices). Further, if a Mobile Device Management (MDM) solution is enabled, it will be necessary for the Sandline Global team to work with the Corporate IT team to relax or temporarily disable the solution.