GA/T 1069-2013Forensic sciences - Technical specifications for examination of mobile phones as the electronic evidence (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" drafted.

This document replaces GA/T 1069-2013 "Technical Specifications for Mobile Phone Inspection of Forensic Science Electronic Evidence", which is consistent with GA/T 1069-2013 in addition to editorial changes, the main technical changes are as follows.

--- Changed the definition of mobile phone inspection and mobile phone card (see 3.1, 3.2, 3.1, 3.2 of the 2013 edition);

--- Added the terms and definitions of "mobile phone memory chip" and "mobile phone body mirror" (see 3.4, 3.5);

--- Changed the software and hardware equipment (see 4.1, 4.2, 4.1, 4.2 of the 2013 edition);

--- Changed the contents of the operation steps (see 5.1, 5.2, 5.1, 5.2 of the 2013 edition);

--- Changed some of the contents of virus detection (see 5.3.1, 5.3.1 of the 2013 version);

--- Changed the mobile phone body inspection content (see 5.3.2.1, 5.3.2.2, 5.3.2.1, 5.3.2.2 of the 2013 edition);

--- Added mobile phone body inspection content (see 5.3.2.3, 5.3.2.4);

--- Changed some content of mobile phone card inspection (see 5.3.3.1, 5.3.3.2, 5.3.3.1, 5.3.3.2 of the 2013 edition);

--- Changed the content of mobile phone expansion memory card inspection (see 5.3.4.1, 5.3.4.2, 5.3.4.1, 5.3.4.2 of the 2013 edition);

--- Deleted result saving, checkout data recording (5.3.5, 5.4, 5.4.1~5.4.4 of the 2013 version);

--- Increase the preservation of test results (see 5.4);

--- Changed some of the contents of the presentation of the test results (see Chapter 6, Chapter 6 of the 2013 edition);

--- Changed some contents of the supplementary regulations (see 7.1, 7.2, 7.1~7.3 of the 2013 edition).

Please note that some content of this document may be patented. The issuing agency of this document assumes no responsibility for identifying patents.

1 Scope

This document specifies the terms and definitions, instruments and equipment, operating procedures, and test result tables of mobile phone inspection of electronic evidence in the field of forensic science.

referring to the by-laws.

This document applies to the inspection of electronic evidence mobile phones in the field of forensic science.

2 Normative references

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.

GB/T 29360 Electronic material evidence data recovery inspection procedures GB/T 29362 Electronic material evidence data search and inspection procedures

3 Terms and Definitions

The following terms and definitions apply to this document.

Using the principles, methods and procedures of physical evidence identification to extract and analyze the electronic data contained in the mobile phone body, mobile phone card and mobile phone expansion memory card data process.

mobile phone card

The mobile phone user identification card with microprocessor is used to record the user's electronic data, mainly including SIM card, UIM card, PIM card and USIM card, etc.

The storage media used to expand the physical storage space of mobile phones mainly include SD cards, MMC cards, miniSD cards and MS cards.

Flash memory chips in mobile phones that store operating systems, application software, and user data.

The mobile phone memory chip contains a physical storage bit-to-bit data copy of the user data partition.

4 Instruments and equipment