Taking a screenshot of a connected iOS or Android mobile device consists in making a copy of what is displayed on the device screen. This method makes it possible to collect digital evidence that would otherwise not be available in a advanced logical acquisition because the data is protected.
Mobile Device Investigator and ADF's PRO mobile phone forensic software products provide investigators and examiners with a Screenshots Capture screen to use during a forensic preview or investigation. Collected at before starting the logical acquisition, an investigator can capture screens and collect data to be included with the logical acquisition. In ADF, there are 2 ways to access the Screenshots Capture screen:
The Screenshots Capture screen displays the following panels:
After the screenshots have been collected, they are part of the advanced logical acquisition and need to be scanned to be processed and appear in a scan result. If the mobile device was scanned with a Search Profile containing the Screenshots Capture then all screenshots will be processed as part of the scan. If the mobile device was acquired, then the logical acquisition needs to be scanned by selecting the Add Phone Backup button on the Scan screen.
Once processed, the screenshots appear in the Screenshots Capture view.
Captured Screenshot images are run through Optical Character Recognition within the ADF software so that evidence collected is included for analysis.