The digital-evidence intake 场景学习单

An unlocked phone passes between several desks while screenshots are copied into personal message threads.

一部未锁定的手机在多个工位间传递，截图被复制进私人聊天。

DETECTIVE

The pattern is obvious. Let me search everything before the owner changes the account.

模式已经很明显了。趁机主修改账户前，让我搜索所有内容。

EXAMINER

A brilliant interpretation cannot repair evidence whose origin and handling are unknown.

再精彩的解读，也无法修复来源和处理过程不明的证据。

EXAMINER

Confirm legal scope, photograph the device, isolate it from networks and preserve an exact acquisition with a verified hash.

确认合法范围，拍摄设备状态，隔离网络，并用经验证的校验值保存精确取证副本。

DETECTIVE

We will analyze a working copy, log every access and seek new authority before opening data outside the approved scope.

我们会分析工作副本，记录每次访问；打开获准范围之外的数据前，先取得新的授权。

The phone enters sealed storage while the team receives a scoped forensic copy and access log.

手机进入密封存储，团队获得范围受限的取证副本和访问日志。