ForensicAnalysisofMobileMalware·Chapter9 297 microprocessor except there is a restriction on its size and it is limited through its power consumption. Another component of the mobile device is some form of input device, such as a keypad or touch screen. In addition to these components, an essential component is the operating system that is running the software for the PDA device. Investigative Methods of Mobile Forensics Four main steps are employed when performing a forensic investigation of any device. These four steps are: 1. Examination 2. Identification 3. Collection 4. Documentation We start off by securing the evidence. It is essential that you follow a process that has been approved by legal counsel to secure the mobile device. When you seize a mobile device, you must make sure you take the device, the docking cradle, and any external memory cards. This is probably one of the most difficult things to control and requires that