SD cards are the most compact data storage available today. SD cards are often available for use in smartphones and sometimes improve the performance of the device since they prevent the internal memory on the device from being overused. Some devices, such as iOS devices, do not allow for the use of an SD card. This forces the consumer to purchase a device with a greater storage capacity.

There are three physical sizes of SD cards: original, mini, and micro. Most of the smaller SD cards come with an adapter that can be used to acquire the media. Most SD card readers have slots for each physical size.

Storage size differs for SD cards. Standard SD cards are 2 GB maximum in size. Micro Secure Digital High Capacity (SDHC) stores between 4 GB and 32 GB and are the most common SD cards found in smartphones. A 32 GB SD card allows for a lot more storage than what we are used to seeing on these devices. Secure Digital Extended Capacity (SDXC) can store between 32 GB and 2 TB of data. Most modern Samsung (and not only Samsung) phones supporting SDXC can reach at least 512 GB. We see them quite often.

Remember, these devices are transient. Consumers may reuse these SD cards, and you might be surprised to find information relating to other smartphones, cameras, and computers during your investigation.

Although it may take longer, the best method for acquiring SD cards found in smartphones includes:

1. Acquire the smartphone with the SD card inserted in the handset.

2. Remove the SD card and acquire using a tool such as FTK Imager.

3. Examine with both traditional forensic tool (EnCase, XWAYS, Autopsy, FTK, etc.) and mobile device forensic tools.