Expertise is meant to be shared.

Logical acquisition retrieves information through interfaces supported by the device. File system acquisition may access a broader structure and more artefacts, depending on the available method.

Physical imaging aims to copy the storage space accessible to the procedure used. On modern devices, physical data does not necessarily provide decrypted information or all deleted data.

Selection should be based on the assignment's objective and an assessment of the media's model, version, condition and encryption.

A hash function such as SHA-256 computes a fingerprint from specific bytes. Comparing a file's fingerprint at two points in time checks whether its content matches.

The fingerprint alone does not establish who created the file or whether the device was altered before acquisition. It needs media identification, a procedure record and context.

Live acquisitions and systems that change during reading require an explanation of what was verified and when.

A memory read may contain pages with errors, reorganised blocks and data distributed by the controller. Reconstructing usable information may require error correction and recovery of the logical organisation.

With embedded memory, encryption and device-bound keys may prevent interpretation of a standalone chip read.

Before extracting or desoldering components, assess whether the intervention preserves access to the keys and whether less invasive alternatives exist.