Procedures should include documentation of all text messages from the systems management server (SMS), including
- those on a cellphone, using a camera
- deleted messages on a cellphone by forensically acquiring the logical data from the cellphone
- deleted messages, on a cellphone by examining the logical data forensic image acquired from the cellphone.