The DEFR decides whether to collect or acquire, balancing circumstances, cost, time, resources and priorities. Disconnected devices follow clause 5.4; a device that cannot be taken off the network because its function is critical or evidence would likely be destroyed is acquired live while still connected, using sound standard procedures, validated tools, good records and a trained, experienced DEFR. Mobile devices are harder: they can be in several states and interact by Bluetooth, radio, touch screen and infrared, run differing operating systems that need different acquisition methods, and use memory cards whose removal while running may disturb processes. They usually have to be on to be acquired and keep changing (their clock updates), so two copies may not give the same hash, and verification that shows where copies agree or differ may be better. The DEFR brings no Wi-Fi or Bluetooth devices that could change pairing records, which matter when finding out what was connected. If acquiring, network devices are left running for further analysis of what else is connected, and the DEFR weighs the risk of the suspect sabotaging the system over a live connection, then decides whether to monitor or disconnect.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.