Mobile forensics: frequently asked questions

Mobile device forensics is the documented preservation, acquisition, examination and interpretation of data from phones, tablets and related sources. Its purpose is to answer defined evidential questions, not simply retrieve files. A sound examination connects findings to their source, explains material limitations and separates observed records from inference and opinion.
The DDD Method

We examine a wide range of Apple iOS and iPadOS, Android and Huawei HarmonyOS devices. Feasibility depends on the exact model, software version, security state and available credentials.
Acquisition feasibility and device state

Sometimes, but not in every case. Prospects depend on the application, database behaviour, encryption, elapsed time, subsequent use, backups and whether related evidence exists elsewhere.
Acquisition feasibility and device state

Available chats, attachments, calls and account artefacts may be recoverable from a device, backup or linked source. Deleted content cannot be promised and must be assessed case by case.
WhatsApp evidence

Potential sources include the active database, residual files, media, computer clients, backups and counterpart evidence. Modern encryption and database cleaning can materially limit recovery.
WeChat evidence

Signal is designed to minimise retained data. Some related artefacts may remain, but disappearing content is often unavailable. We report the boundary between recovered evidence and inference.
Signal evidence

A correct passcode or other lawful credentials can substantially improve acquisition options. We first assess the device state and available access without making assumptions about what can be bypassed.
Acquisition feasibility and device state

Do not experiment with the device. Preserve its current state, prevent unnecessary use and seek advice promptly. Whether it should remain powered depends on its condition, connectivity and the circumstances.
How should a phone be preserved before forensic examination?

Some mobile acquisitions necessarily interact with the operating system. We select the least intrusive proportionate method and document material actions, limitations and resulting artefacts.
How should a phone be preserved before forensic examination?

A screenshot can be assessed, but it is a selected representation rather than the underlying conversation. Compare the original image file, its provenance and relevant application records where available. A matching record may support consistency, while completeness, earlier editing and human authorship remain separate questions. A plausible appearance or unchanged file hash is not enough on its own.
Can a WhatsApp screenshot be authenticated?

The evidence may support attribution, but account association, device use and human authorship must be separated. Relevant material can include identifiers, access history, linked endpoints, surrounding activity and independent records. Shared access, compromise and automated activity may need consideration. The conclusion must identify what is supported and what remains unresolved.
Can an examiner prove who sent a message?

Potentially, where the necessary authority, access and a suitable collection method are established. A service name or account password does not guarantee readable content. We distinguish device backups, application archives, synchronised account data and provider exports, then assess their dates, encryption, scope and relationship to the handset.
Cloud, backup and account evidence

Available attachments, cached copies, thumbnails, exports and file-system traces can be examined. Recovery and metadata completeness depend on how the application stored and later handled the files.
What can media metadata and provenance establish?

Sometimes, but each timestamp must be tied to its actual meaning: creation, sending, delivery, marking as read, editing or export. Time zones, clock settings, precision and application behaviour can affect interpretation. A read receipt records an application state; it does not by itself prove that a particular person saw, understood or agreed with the content.
Can message timestamps and read receipts be relied upon?

A reset commonly destroys encryption keys and makes prior handset data inaccessible. Backups, synchronised accounts, linked computers, recipients and other external sources may still merit examination.
What can be established when a phone has been reset or reused?

Yes. Comparing both sides can expose missing messages, different timestamps, altered exports, media provenance and account differences, while also explaining legitimate synchronisation effects.
What if two participants’ phones contain different chats?

Potentially. The instructing party must have appropriate authority and access arrangements. We can also review lawful forensic exports or reports supplied by another examiner.
Independent review of forensic evidence

Timescales depend on device access, data volume, the issues in dispute and the reporting required. A focused examination may be quicker than broad recovery and reconstruction across several sources.
Acquisition feasibility and device state

The reporting format and level of detail are agreed at the outset. Reports identify the relevant instructions, materials, methods, findings and supporting evidence. Material limitations, uncertainty and adverse findings relevant to the conclusions will be disclosed.
Independent review of forensic evidence

Enquiries and accepted instructions are handled confidentially under applicable law and engagement terms. Initial contact does not create legal professional privilege. Do not send evidence or credentials before conflict checks and transfer arrangements are confirmed.
Credential and evidence-transfer protocol

Potential sources include available Apple, Google, Microsoft, Huawei, messaging, email, social-media and storage services. Actual support and returned content depend on the service, region, account configuration and acquisition date.
Cloud, backup and account evidence

No. A listing identifies a potential route only. Access may depend on lawful authority, credentials, a valid session, multi-factor authentication, subscription status, encryption, provider support and retention.
Cloud, backup and account evidence

In some circumstances, an authorised linked-session workflow may collect available account data. Linking can generate notifications and account events, change account state and provide only the history exposed to that session. It requires separate authority and documentation; it does not bypass encryption or recreate expired content.
WhatsApp evidence

Usually not. Cloud and device sources can contain different records, timestamps, metadata and retention gaps. The strongest assessment commonly correlates the account return with the handset, backups and linked devices.
Cloud, backup and account evidence

Yes, where the format is compatible and provenance is sufficient. We first assess acquisition notes, hashes, scope, completeness and any processing already applied before relying on the material.
Independent review of forensic evidence

Sometimes. Database journals, write-ahead logs, freelists, unallocated database pages and related caches may retain fragments, but modern encryption, vacuuming, overwriting and application design can prevent recovery.
Acquisition feasibility and device state

Potentially, after assessing the exact damage, model, encryption and current state. A connector fault, damaged display and failed storage present different problems. Repair or hardware intervention can alter evidence and requires a separate plan; removing a memory component does not automatically defeat encryption. The initial assessment should not be treated as a promise of specialist hardware recovery.
Acquisition feasibility and device state

No. Acquisition depth depends on the exact model, chipset, operating-system and security-patch version, lock state, credentials and currently supported methods. A backup or targeted acquisition may sometimes be the most defensible route.
Acquisition feasibility and device state

Yes. Services may compress media, convert formats, rename files or expose different fields through their interfaces. We document the acquired representation and avoid assuming it is identical to the original upload.
Cloud, backup and account evidence

We assess the exact device and application versions, current state, credentials, relevant dates, deletion or reset event, backups, linked endpoints, cloud configuration and available counterpart evidence before defining scope.
Acquisition feasibility and device state

The scope, access conditions, number of sources, data volume, complexity of interpretation and reporting requirements affect cost. A recovery attempt, a focused question and a broad reconstruction are different instructions. Ask for the proposed stages, assumptions, exclusions and approval points before work begins. No universal price or recovery outcome can be inferred from the device model alone.
Request a feasibility assessment

No. It may mean the material was absent from the examined source, outside the agreed scope, inaccessible, omitted during acquisition or not identified by the processing and searches performed. The report should state which applies. A negative finding is meaningful only in relation to the sources and methods actually examined.
What does “no relevant data found” actually mean?

Yes. Records can be omitted, misclassified or interpreted incorrectly. Material findings should be checked against source structures and relevant field meanings, with processing versions and limitations recorded. Agreement between two reports is useful only to the extent that the comparison genuinely tests the disputed interpretation.
Can forensic software misinterpret mobile evidence?

No. A matching cryptographic hash supports consistency between the bytes compared. It does not establish the truth of the content, the creator, completeness or what happened before the first recorded hash. A fabricated or selectively exported file can remain unchanged after it is hashed.
Evidence quality and confidence

Not necessarily. A screenshot, a PDF containing it and a report quoting that PDF can all derive from one item. Establish how each copy was created and whether it provides genuinely separate information. Even records from different devices may share a synchronised source.
Evidence comparison tables

It may retain useful information, but forwarding, downloading or conversion can change filenames, metadata and the relationship to the original conversation. Preserve the received file and identify the transmission path where possible. A forwarded copy should not automatically be described as the original recording.
What can media metadata and provenance establish?

Only if a suitable, authorised method and the necessary access material are available. Protected folders and vaults can use separate accounts, keys or security boundaries. Access to the main phone does not guarantee access to their contents, and a product label does not establish which implementation or version is present.
Acquisition feasibility and device state

They can. Separate profiles or application instances may hold different accounts, containers and retention histories. The examiner should identify which instance produced a record and what the acquisition included. Messages from separate profiles must not be merged merely because they display the same contact name.
Android forensic assessment

It should not be treated as a substitute for the handset and application data. Subscriber identity, carrier records, handset databases and internet-messaging accounts are different sources. Identifying a number or subscription does not establish that every communication is stored on the SIM or eSIM, or who used it at a particular time.
Can an examiner prove who sent a message?

No. A call-history entry and an audio recording are different artefacts. An entry may record parties, direction, time or duration, subject to validation. It does not by itself establish the spoken content, who was speaking or whether a recording exists elsewhere.
Evidence quality and confidence

They can assist review, but the original material must remain traceable. Record the translation or transcription method, relevant language or dialect, and uncertainty. Disputed wording may require suitably qualified language expertise. An extracted message, an automated transcript and a verified translation are not the same evidential item.
Independent review of forensic evidence

No. A setting may explain retention behaviour, but does not by itself establish motive, knowledge or the content of expired messages. Establish when the setting applied, which conversation it affected and what other evidence bears on the allegation. Routine privacy settings are not automatically evidence of wrongdoing.
Signal evidence

No. Signal states that its PIN is not a chat backup and is separate from backup recovery material. A retained, compatible archive and its required key or passphrase are a different question. Preserve any existing archive and seek advice before attempting a restore on an evidence device.
Signal evidence

No. Synchronisation maintains related data across systems and can propagate changes; a backup preserves a configured representation at a particular time. For example, Apple distinguishes content synchronised with iCloud from device-backup contents. Identify the actual source and date rather than assuming that “in the cloud” means a historical copy remains.
Can messages be recovered from iCloud or Google backups?

Yes, depending on the service and action. A login, export or new linked session can generate records or notifications and may affect synchronisation. Agree authority and a collection plan first, record material actions, and distinguish pre-existing records from events created by the collection itself.
Can linking a device change the evidence?

Telegram secret chats are device-specific and distinct from cloud chats. A cloud-chat export should not be represented as a secret-chat archive. Any retained evidence from an original participating endpoint requires its own assessment of access, provenance and scope.
Can deleted Telegram messages be recovered?

No. A tenant export, compliance copy and handset acquisition can differ in content, attachments, timestamps and retention. Record the accounts, channels, dates, permissions and collection settings covered by each. Administrator access alone does not establish authority over every private or third-party record.
Cloud, backup and account evidence

Not by itself. A chat reference, application transaction artefact, screenshot and formal financial record can establish different things. Correlate available identifiers, parties, amounts, status and dates with appropriate independent records before concluding that a payment completed or a named person controlled the funds.
Can WeChat payments and red-packet records be examined?

Sometimes the evidence supports a finding about generation or manipulation, but no universal test proves every item genuine or detects every fake. Preserve the actual file and its provenance. A detector score, absent metadata or visual anomaly is not a complete conclusion by itself. The specific question and any specialist expertise required must be agreed.
Can mobile evidence reveal whether an image, voice note or video was AI-generated?

Potentially. Available device records, authorised account exports, attachments and shared conversation links may be relevant sources. Their existence and completeness must be assessed for the particular service and account. Generated text does not automatically establish what a user believed or did. This is a source-assessment question, not a claim of support for every AI application.
Cloud, backup and account evidence

Preserve the original values, identify each field’s meaning and convert to a stated reference time where justified. Record the relevant offset, daylight-saving treatment where applicable, precision and any known clock discrepancy. Do not infer the device’s time zone from the owner’s address or silently replace original timestamps with converted values.
Can message timestamps and read receipts be relied upon?

No. The label describes an intended acquisition scope, not proof that every protected, deleted, cloud-held or inaccessible item was obtained. Identify what was collected, what was excluded or failed, and which records could actually be interpreted. Completeness must be assessed against the question and source, not inferred from the word “full”.
What is the difference between logical and file-system extraction?

No. The conclusion must follow the evidence, including material that contradicts the instructing party’s account. An examination may support, qualify or challenge a proposition, or remain inconclusive. A technical service cannot promise a favourable result or a particular decision by a court or other decision-maker.
Independent review of forensic evidence

They may have different sources, acquisition dates, access, software versions, filters or instructions. They may also interpret a field differently. Compare these conditions and trace the material conclusions to their sources before deciding whether the difference is an error, a scope limitation or a reasonable unresolved interpretation.
Independent review of forensic evidence