Memory card forensics
Memory cards may contain a vast amount of data. Any kind of file may be stored on a memory card, from standard photographs taken by the handset camera to Microsoft Excel© spreadsheets containing detailed financial information, and more.
To prevent any further data being written to the card, the memory card is removed before the handset is activated and is then examined using the forensic application, Encase. This program takes a complete image of the card and verifies it using an MD5 hash, a mathematical equation that highlights any difference between the created image of the card and the data stored on the card itself.
The card is searched for all relevant data types, which are logged in the analyst's notes and are can be made available in court at any time.