I'd say it's ok, first, to image the sd using a write blocker in order to preserve integrity and then the device with the sd inserted. This may be the only way to analyse the data if sd encryption is on. Of course it should be used an acquisition that will be able to acquire the sd card..
November 16, 2024 at 9:51 AM
I'd say it's ok, first, to image the sd using a write blocker in order to preserve integrity and then the device with the sd inserted. This may be the only way to analyse the data if sd encryption is on. Of course it should be used an acquisition that will be able to acquire the sd card..