Mobile-device forensic examination
Examination of available iOS or Android system, application, configuration and security artefacts: relevant diagnostic records, installed-app provenance, profiles, VPN and mobile-device-management configuration, permission state and available indicators, with incident-timeline correlation. Technical availability depends on device model, OS version, access state and acquisition method.
