Investigators believe a stolen city-issued phone holds messages relevant to a fraud case. What must guide collection of mobile-device artifacts?

Collecting mobile-device artifacts for a fraud investigation is a digital forensics and legal-process activity, not casual IT imaging. Investigators who believe a stolen city-issued phone holds relevant messages must obtain proper legal authority—warrant, consent, or other counsel-approved basis depending on jurisdiction and ownership—and then follow forensic procedures that preserve integrity: documented chain of custody, write-blocking or validated tools where applicable, hashing, controlled acquisition, and limited handling. Skipping those steps can render evidence inadmissible and expose the city to privacy and liability claims.

Imaging every employee phone citywide without suspicion or authorization is overcollection and likely unlawful or policy-violating fishing. Wiping the device immediately to reuse hardware before legal review destroys potential evidence and undermines the case. Posting screenshots of phone contents to a public incident blog violates confidentiality, risks defamation and privacy breaches, and contaminates investigative control of the material.

Exam caveat: investigations may include mobile artifacts (messages, apps, location), but legal authority and forensic soundness are mandatory themes. Employer ownership of a device does not automatically authorize every search in every jurisdiction—process still matters. Integrity and chain of custody are core CISSP investigation concepts.

Operational check: route suspected evidentiary phones to a defined legal-and-forensics intake path, freeze routine wipe/reuse, use approved acquisition procedures, and keep public communications free of raw evidentiary content.