Smartphones commonly have SD cards and SIM cards, which contain unique data that may not be captured during forensic acquisition of the device. It is best to assume that the data saved on these devices (the SIMs and SD cards) will not be acquired during the smartphone acquisition and to acquire each individually.

SD cards can be acquired using most smartphone forensic tools; however, a tool like FTK imager is free and may work faster. When acquiring an SD card, ensure that your card reader is write protected to ensure changes are not made to the media. Always test your write protection method prior to acquiring evidence.

Prior to pulling a SIM card from a device, make sure you have already acquired the data. Some SIM cards will lock the device and possibly put it in a BFU state. SIM cards can be acquired using most smartphone forensic tools. With modern devices, the SIM card is often not acquired during forensic extraction, and data can be saved to these devices. We will cover more on SIM card data in Section 2 of this course and how Android saves user data to the SIM. Best practices state to acquire the SIM card and review it for user-created data. Methods for SIM extraction and bonus Lab 1 are included in the Bonus Section within your media files. Try this lab if you are curious as to what a file system extraction of a SIM card reveals.