2 ms·
In that case it can't alter any evidence in an undetectable way - it can't alter the disk or chip itself; and it can't alter the image without changing the (alr
by PeterisP 6y ago
In that case it can't alter any evidence in an undetectable way - it can't alter the disk or chip itself; and it can't alter the image without changing the (already recorded offline) image hashes.
- sitkack 6y agoHow do you know that? If the imported data pops the host process, it could take over the host and mount the phone read/write.