The technologies are changing at a rapid pace and computer forensics must keep pace with events. The guidelines proposed by institutions concerning the digital forensics and incident response are not progressing at the pace required technology. In addition, there are relevant guidelines on specific issues of forensic process that are not taken into account by people who start this process. From the academy, a practical model, which consists of eight phases is proposed, and integrates the forensic process and best practices in the management of digital evidence and chain of custody in order to provide guidance in learning and study forensic digital analysis using a post-mortem methodology and directing it towards a mobile device with the Android operating system. Through the guide will detail all the knowledge you must have the forensic investigator before, during and after forensic investigation.