Dedicated to the branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. This field involves the application of several information security principles and aims to provide for attribution and event reconstruction following forth from audit processes. This subreddit is not limited to just personal computers and encompasses all media that may also fall under digital forensics (e.g., cellphones, video, etc.).
Say Department A has a phone and has been trying to crack it for a few months.
Attorney B would like to examine the phone, but they won't stop the Graykey process to allow Attorney B (client has passcode) to image the phone.
I thought I was told that Graykey can stop, mark the point it stopped at, like to allow another phone that took priority to be connected, and then restart at a later time from that exact point.
Is that right or wrong?