MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cardsNIST SP 800-72 Guidelines on PDA Forensics
NIST SP 800-72 is a 2004 guide to a class of device that no longer exists. It is on this site because its state model, roles and principles survived into the mobile forensics guidance that replaced it.
StandardNIST2004Final on NIST's page, historic; not withdrawn as of November 2026Reviewed 2 November 2026
NIST SP 800-72, Guidelines on PDA Forensics, was published in November 2004 by Wayne Jansen and Rick Ayers of NIST, with sponsorship from the US Department of Homeland Security. It runs to 67 pages and covers three families of personal digital assistants, Pocket PC, Palm OS and Linux-based devices, together with the forensic tools of the day and procedures for preservation, acquisition, examination, analysis and reporting.
Its stated aims were to help organisations develop policies and procedures for PDAs and to prepare forensic specialists for devices they had not met before. Like every NIST forensic guide it says it is not a step-by-step manual and not legal advice, that the judgement of the specialist should be given deference and that legal counsel should be consulted. For the authors and NIST it was the first step toward the mobile device guidance that followed.
Status, Honestly Stated
We checked NIST's publication page on 2 November 2026. It lists NIST SP 800-72 as Final, with a single document history entry of 1 November 2004, no withdrawal date and no superseding publication. So the document has not been formally withdrawn or superseded, and a reader who sees it described as withdrawn should check the page before repeating that.
At the same time it is plainly historic. The devices it covers stopped being made long ago, its tool chapter describes software such as pdd, pilot-link, the Palm OS Emulator and PDA Seizure that no laboratory now runs, and NIST's own subject coverage moved to NIST SP 800-101 in 2007 and NIST SP 800-101 Rev. 1 in 2014, which handle phones, smartphones and tablets. Cite NIST SP 800-72 for its ideas and its place in the history of the discipline, not as guidance for any current device.
The Generic Device State Model
Chapter 2 introduces a four-state model that was later carried into mobile device forensics. It matters because the state a device is in decides whether data is at risk and what powering it on or off will do.
- Nascent
As received from the factory, with no user data. A hard reset or a fully drained battery returns a device to this state, which is the warning: on these devices, letting the battery die could erase the evidence.
- Active
Powered on and in use, with user data in the file system. Authentication, if set, is asserted when the device enters this state.
- Quiescent
A dormant, power-saving state that keeps user data and context in memory for a quick resume. Reached by the power button or an inactivity timer.
- Semi-Active
A state between active and quiescent, reached by a timer that dims the display to save power, from which a tap or button press returns the device to active.
Key Terms and Ideas
E
- Evidential Principles
- The guide restates the four principles of the UK ACPO good practice guide and the similar principles of the International Organization on Computer Evidence: do not change the data, be competent if you must access the original, keep an audit trail a third party can review and accept responsibility for compliance with the law.
O
- Obstructed Device
- A device protected by a password or other lock, or damaged, treated in chapter 6 as a separate acquisition problem from an unobstructed one. The term lived on in NIST SP 800-101 Rev. 1.
R
- Reliability Factors
- It lists the factors courts in the United States use to weigh a scientific technique, namely testability, peer review and acceptance, known error rate, the expert's standing and clarity of explanation, as things to keep in mind when choosing and reporting a method.
- Roles
- Chapter 4 names first responders, investigators, technicians, evidence custodians, forensic examiners and forensic analysts and gives each a responsibility. The list is still a sound way to divide work in a laboratory.
S
- Soft Reset and Hard Reset
- A soft reset clears working memory and returns the device to its active state; a hard reset wipes user data and restores factory settings. Knowing which a button combination does was, and is, a matter of evidence survival.
T
- Tangential Equipment
- Cradles, synchronisation software on a paired computer, memory cards and power adapters, all treated as sources of evidence in their own right.
What It Still Teaches a Laboratory
Nobody applies this guide to a device today. These are the habits it established that a laboratory still practises, in the order the guide presents them.
- 01Treat Power as Evidence
A seized handheld with volatile storage needed charging, not switching off. The modern form of the lesson is to understand what a device does to its data on power loss, lock timeout or reboot before deciding how to transport it.
- 02Follow the Scene Model
Secure and evaluate the scene, document it, collect, then package, transport and store with a chain of custody. The guide borrows this from the US Department of Justice first responder guide and NIST SP 800-101 Rev. 1 keeps it unchanged.
- 03Decide Unobstructed or Obstructed Before Choosing a Method
The guide separates devices that will give up their data through normal interfaces from those that will not, and asks for the second kind to be handled with more care and more authority.
- 04Keep Four Stages in the Report
Preservation, acquisition, examination and analysis, reporting. The guide calls this its simple framework and the mobile guides after it kept the same four headings.
- 05Know the Limits of the Tool
Its tool chapter is a catalogue of partial coverage, with a table of which tools worked on which devices. The practice of recording what a tool could not reach began here.
What It Does Not Do and Common Misunderstandings
- It does not describe any phone, smartphone or tablet. Citing it in a report about a current device invites a question the examiner cannot answer well.
- Its tools and device internals are of historical interest only. Do not look for current acquisition paths in it.
- It is not formally withdrawn or superseded, but it is also not where NIST's current thinking on mobile devices lives. NIST SP 800-101 Rev. 1 is.
- It is a United States federal guideline, usable voluntarily by others, with no standing in Indian law.
- The court factors it lists are American. Indian courts weigh expert evidence under Indian evidence law, and the guide itself says that laws and rules may require actions other than those it describes.
- It is not a certificate and no accreditation attaches to it.
How It Fits With the Other Standards on This Site
Read this guide as the first draft of NIST SP 800-101 Rev. 1. The roles, the evidential principles, the scene model, the device state idea and the four-stage structure all pass from one to the other almost unchanged, while the devices and tools are replaced. The SWGDE Best Practices for Mobile Device Evidence Collection and Preservation, Handling and Acquisition (18-F-003, version 2.0) is where those ideas are kept current for today's phones.
The principles chapter is also a short history of where digital evidence rules came from: the ACPO guide, the International Organization on Computer Evidence and the US Department of Justice guides. ISO/IEC 27037:2012 later turned the same principles into an international standard, and a student who reads NIST SP 800-72 alongside it will see how little the fundamentals have moved in two decades.
Common Questions
Should we remove it from our laboratory's list of references?
Keep it in the historical section if you keep one, and cite NIST SP 800-101 Rev. 1 and the current SWGDE documents in your procedures. A reference list that quotes a 2004 PDA guide for a modern phone examination weakens the report.
Why does DFRTI teach it at all?
Because learners who see where the device state model and the evidential principles came from understand why the current rules exist, and because older devices still turn up in long-running matters.
Is there any case where it is the right reference?
An examination of an actual Pocket PC, Palm OS or early Linux handheld recovered from storage, for example in a historical or archival matter. Even then its tools will not be available and the examiner will need to document a new method.
Official sources
This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.
Disciplines where this applies
Courses that teach it
MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cards
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.