SWGDE Best Practices for Mobile Device Evidence Collection & Preservation, Handling and Acquisition
Scientific Working Group on Digital Evidence · Version 2.0, published 2025-08-21 · 2025
Identifier: SWGDE 18-F-003-2.0
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
SWGDE's guidance on the front half of mobile device work: isolating and preserving a seized handset, handling power and network state, and choosing among logical, file system and physical acquisition routes. The version verified here is 18-F-003-2.0 dated 21 August 2025.
Who it is for, and when
Read it before any phone seizure, and read it again when explaining why a device was or was not isolated, or why an extraction is partial. Its companion document, 20-F-005-2.0 (Best Practices for Mobile Device Forensic Analysis, 23 June 2026), covers the analysis side.
What it does not cover
It does not cover analysis or interpretation of extracted data, nor does it address the legal authority for compelling passcodes or biometrics. It cannot keep pace with every handset and OS release, so device-specific limitations still have to be established and documented case by case.
Go to the source
Open at swgde.org (opens in a new tab)https://www.swgde.org/wp-content/uploads/2025/09/2025-08-21-Best-Practices-for-Mobile-Device-Evidence-Collection-Preservation-Handling-and-Acquisition-18-F-003-2.0.pdf
Details
- Type
- Standard or guidance
- Written for
- Working examinerWorking examiner
- Publisher
- Scientific Working Group on Digital Evidence
- Version verified
- Version 2.0, published 2025-08-21
- Year
- 2025
- Identifier
- SWGDE 18-F-003-2.0
- Topics
- mobile, evidence-handling, chain-of-custody, imaging, us-federal
- Checked at source
- Standards are revised. Confirm the current revision with the publisher before citing this.
Related entries
An NIJ special report, produced by the Technical Working Group for the Examination of Digital Evidence, covering policy and procedure, evidence assessment, acquisition, examination, documentation and reporting. It is the second guide in NIJ's digital evidence series, after the first responder guide.
NIST's guidance on seizing, preserving, acquiring and examining mobile phones and their associated media, including the acquisition-level model (manual, logical, physical, chip-off, JTAG) that practitioners still use as shared vocabulary. It supersedes the 2007 first edition of SP 800-101.
A 38-page international standard covering the first four handling activities for potential digital evidence: identification, collection, acquisition and preservation. It names the device classes in scope, including computer storage media, mobile phones, memory cards, navigation systems, still and video cameras including CCTV, and TCP/IP networks.
SWGDE's core on-scene collection document, covering preparation, data integrity and security, acquisition approaches, hashing and documentation. The version verified here is 18-F-002-2.0 dated 20 November 2025.
NIJ's first-responder guide covering electronic device types and their potential evidence, on-scene tools and equipment, securing and documenting the scene, collection, and packaging, transport and storage of digital evidence, plus a chapter of considerations organised by crime category.