Cookies on the
LGC website
We use cookies to ensure that we give you the best experience on our website. If you continue without changing your settings, we’ll assume that you are happy to receive all cookies on the LGC website. However, if you would like to, you can change your cookie settings at anytime.
Question markFind out more

Memory card forensics

Memory cards may contain a vast amount of data. Any kind of file may be stored on a memory card, from standard photographs taken by the handset camera to Microsoft Excel© spreadsheets containing detailed financial information, and more.
 
To prevent any further data being written to the card, the memory card is removed before the handset is activated and is then examined using the forensic application, Encase. This program takes a complete image of the card and verifies it using an MD5 hash, a mathematical equation that highlights any difference between the created image of the card and the data stored on the card itself.
 
The card is searched for all relevant data types, which are logged in the analyst's notes and are can be made available in court at any time.