Conversation records
Message databases can record content, direction, status, replies, reactions, edits, group events and internal identifiers.
Court-aware mobile evidence
The device is
only the beginning.
Mobile devices can hold records of communications, activity and transactions. Their significance depends on context, corroboration and alternative explanations. D3Forensics preserves, examines and explains the evidence using documented methods.
EXAMINATION / 001● EVIDENCE LED
09:41D3FORENSIC IMAGE
PLATFORMS 03APP GUIDES 13PROCESS DOCUMENTED
Forensic rigour from instruction to evidenceLaw firmsCorporatesInvestigatorsPrivate clients
Platforms
Every device tells
a different story.
Our examination strategy is tailored to the operating system, device state, available credentials and the questions the evidence must answer.
01
iOS Forensics
Acquisition and examination of iPhone and iPad data, iCloud material, application artefacts and system records.
Explore capability 02Android Forensics
Proportionate examination across the fragmented Android ecosystem, including manufacturer and application data.
Explore capability 03HarmonyOS Forensics
Specialist assessment of Huawei devices, HarmonyOS artefacts, cloud data and cross-device activity.
Explore capabilityCloud and imported evidence
The handset is
one evidence source.
Available account data, device and application backups, synchronised services, linked endpoints and existing forensic images can extend or corroborate the local record. Every route remains dependent on authority, configuration, credentials, encryption, retention and current provider support.
Explore cloud forensicsMessaging evidence
Conversations
in context.
A message rarely stands alone. We examine available databases, attachments, calls, accounts, backups and system artefacts to assess what the records support, what remains uncertain and which alternative explanations need testing.
View all messaging applicationsThe categories below describe potential evidence, not a promise of acquisition or recovery. Availability depends on the exact application and platform version, device state, configuration, retention, credentials and lawful access. A listed feature may leave no accessible record in a particular matter.
01WhatsApp
02WeChat
03040506070809
Messages, calls, media, linked devices, contacts and account artefacts
Chats, payments, Moments, social activity and mini-program data
Signal
Encrypted messaging, disappearing content and evidential limitations
Telegram
Cloud and secret chats, channels, groups, media and account activity
Facebook Messenger
Chats, calls, shared media, account identifiers and Meta artefacts
Apple Messages
iMessage, SMS, MMS, attachments, reactions and synchronised records
LINE
Chats, calls, groups, historic Keep artefacts where retained, media and account artefacts
Viber
Messages, calls, communities, media and local database records
Other applications
A broader portfolio including Lark, DingTalk, SafeW, KakaoTalk and more
Method
A defensible path
from data to finding.
Technical capability matters. So does process. We document the methods, findings and limitations so that another competent examiner can assess the work.
01
Scope
Define the questions, devices, authority and proportionate strategy.
02
Preserve
Securely acquire available data and record integrity and handling.
03
Examine
Recover, correlate and test device, application and cloud artefacts.
04
Explain
Present clear findings, limitations and supporting evidence.
Evidence resources
Research the issue.
Preserve the evidence.
Practical, evidence-led guidance built around the questions and scenarios that arise in real mobile-evidence matters.
01
Knowledge Centre
Direct-answer guides covering recovery, authenticity, attribution and preservation.
02Evidence Scenarios
Start from the incident: deleted chats, disputed screenshots, resets and third-party extractions.
03Evidence Matrix
Map potential sources by application, device state, platform and backup availability.
04Reference Tables
Compare extraction types, evidence sources and common interpretation boundaries.
Frequently asked questions
Clear answers.
Careful limits.
Mobile evidence is technically complex and highly fact-specific. These answers explain the starting position without promising results that depend on the device itself.
01What is mobile device forensics?+
Mobile device forensics is the documented preservation, acquisition, examination and interpretation of data from phones, tablets and related sources. Its purpose is to answer defined evidential questions, not simply retrieve files. A sound examination connects findings to their source, explains material limitations and separates observed records from inference and opinion.
02Which devices can you examine?+
We examine a wide range of Apple iOS and iPadOS, Android and Huawei HarmonyOS devices. Feasibility depends on the exact model, software version, security state and available credentials.
03Can you recover deleted messages?+
Sometimes, but not in every case. Prospects depend on the application, database behaviour, encryption, elapsed time, subsequent use, backups and whether related evidence exists elsewhere.
04Can WhatsApp messages be recovered?+
Available chats, attachments, calls and account artefacts may be recoverable from a device, backup or linked source. Deleted content cannot be promised and must be assessed case by case.
05Can you recover deleted WeChat conversations?+
Potential sources include the active database, residual files, media, computer clients, backups and counterpart evidence. Modern encryption and database cleaning can materially limit recovery.
06Can Signal disappearing messages be recovered?+
Signal is designed to minimise retained data. Some related artefacts may remain, but disappearing content is often unavailable. We report the boundary between recovered evidence and inference.
07Do you need the device passcode?+
A correct passcode or other lawful credentials can substantially improve acquisition options. We first assess the device state and available access without making assumptions about what can be bypassed.
08Should I switch the phone off?+
Do not experiment with the device. Preserve its current state, prevent unnecessary use and seek advice promptly. Whether it should remain powered depends on its condition, connectivity and the circumstances.
09Will examining the device alter it?+
Some mobile acquisitions necessarily interact with the operating system. We select the least intrusive proportionate method and document material actions, limitations and resulting artefacts.
10Can a screenshot prove a conversation is genuine?+
A screenshot can be assessed, but it is a selected representation rather than the underlying conversation. Compare the original image file, its provenance and relevant application records where available. A matching record may support consistency, while completeness, earlier editing and human authorship remain separate questions. A plausible appearance or unchanged file hash is not enough on its own.
Confidential case review
