// first 10 minutes

mobile device triage (consent-based) — quick-start

mobile triage — first 10 minutes. consent and safety before acquisition. print this, check boxes, then run the primary tools.

checklist

confirm explicit, informed consent from the device owner before touching the device — document who consented, when, and in what context.
photograph the device (front and back), note make, model, iOS/Android version, and serial number before any extraction.
put the device in airplane mode or a Faraday bag — prevents remote wipe and stops new data from arriving during triage.
note current battery level and plug in if below 30% — acquisition can fail mid-run on a dead battery.
iOS: check if the device is locked or unlocked; note Face ID / Touch ID enrollment status.
android: note if USB debugging is enabled — acquisition paths differ significantly without it.
record the device PIN or passcode from the owner if they consent — required for most logical extraction methods.
check for active cloud sync — iCloud backup, Google auto-backup — and note last sync timestamp.
do not install any apps on the device or trigger backup before extraction — changes modification timestamps.
begin the primary tool path below — mobile triage tool suite.