The legal authority

It is important for the forensic examiner to determine and document what legal authority exists for the acquisition and examination of the device, as well as any limitations placed on the media prior to the examination of the device. For example, if the investigation on the device is being conducted based on a warrant, the search should be limited only to those areas that are defined in the warrant. In short, prior to the device seizure, you need to answer the following questions:

• If a search warrant does not exist, has the device owner consented to the search?
• If a search warrant exists, is the device included within the original warrant?
• If the device is included in the warrant, does it also define what data can be collected?
• If it's a corporate investigation, is the device owned by an individual or his or her employer?
• Does the corporate policy allow collection and subsequent analysis?