D3 Mobile Forensics
Mobile forensics glossary.
Plain-English definitions of mobile-forensic and evidential terminology. A definition explains a concept, not a guarantee of recovery or support. Follow the related guidance for examples, limitations and application-specific context. Where a report uses a term differently, its stated method and definition should be examined.
126 of 126 results
Account acquisition
Collection of available information from an online account or service using authorised credentials, tokens or provider-supported access.
Cloud, backup and account evidenceAccuracy
The extent to which a recorded or interpreted value correctly represents the matter being assessed. A faithfully copied timestamp can still be inaccurate as a measure of event time if the originating clock or field interpretation was wrong.
Evidence quality and confidenceAcquisition
A controlled process used to obtain data from a device, backup, account or other source for examination.
Acquisition feasibility and device stateAcquisition log
A record of collection actions, timings, methods, settings, warnings and outcomes. It helps establish what was attempted and obtained, but does not by itself prove that every relevant item was acquired.
Evidence quality and confidenceADB
Android Debug Bridge, a device communication facility whose forensic usefulness depends on device settings, Android version and authority.
Advanced Data Protection
An optional Apple account setting extending end-to-end encryption to additional iCloud categories; account recovery arrangements become particularly important.
AFU
After First Unlock: a device state after its first successful unlock since restart; it does not guarantee access to decrypted evidence.
What is the difference between AFU and BFU?Agent-based acquisition
A method using temporary software on a supported device to collect accessible data, with actions and limitations documented.
Airplane mode
A device setting that disables some radio connections; it does not always disable every communication path.
Application container
The storage area assigned to an application, commonly holding databases, preferences, caches and files.
Application database
A structured data store used by an application to record messages, contacts, events and other state.
Artefact
A record or trace created by a device, operating system, application or user activity.
Attribution
The reasoned assessment of which account, device or person is associated with an action.
Can an examiner prove who sent a message?Audit trail
A recorded sequence of relevant actions or events that assists reconstruction of handling or activity. Assess its source, coverage, time basis and protection against alteration rather than assuming every audit trail is complete or immutable.
Evidence quality and confidenceAuthentication token
A value representing an authorised account session; its scope, expiry and lawful use must be assessed.
Authenticity
The extent to which an item is what it purports to be, assessed from its origin, history and relevant technical evidence. Authenticity is distinct from whether its content is true, complete or attributable to a named person.
Evidence quality and confidenceBackup
A copy or snapshot of device or application data created locally or in a cloud service.
What does an encrypted backup password change?BFU
Before First Unlock, the protected device state after restart and before the first successful unlock, commonly exposing less decrypted data.
What is the difference between AFU and BFU?Cache
Temporary stored data intended to improve application performance; it may preserve useful residual content.
Carving
Recovery of file content by identifying data signatures rather than relying only on active file-system records.
Evidence quality and confidenceChain of custody
The documented history of possession, transfer, handling and storage of evidential material.
Credential and evidence-transfer protocolChat export
A user-generated representation of a conversation, which may omit database fields, service events or attachments.
Is a provider export the same as a forensic acquisition?Clock drift
The change in a clock’s deviation from a reference over time. It differs from a time-zone offset. Where relevant, record how the deviation was assessed and whether a correction can reasonably be applied to the period in question.
Can message timestamps and read receipts be relied upon?Cloud acquisition
Lawful collection of available data from a cloud account or hosted service.
Cloud, backup and account evidenceCloud backup
A provider-hosted copy of device or application data whose contents depend on configuration, date, encryption and retention.
Cloud, backup and account evidenceCloud chat
A conversation stored or synchronised through a provider’s cloud service, as distinct from device-only content.
Completeness
The extent to which a dataset includes the material relevant to a defined source, period and question. It is a scoped assessment, not a universal property conferred by an extraction label or a readable report.
Evidence quality and confidenceCompliance copy
A retained representation used by a workplace service for compliance or discovery, which may differ from the live application record.
Content Credentials
C2PA-based signed provenance information associated with a digital asset. Validation concerns the credential and its trust context; it does not by itself establish that a depicted event is true. Absence of a credential does not prove fabrication.
Can mobile evidence reveal whether an image, voice note or video was AI-generated?Corroboration
Evidence that supports or qualifies another finding. Assess whether it is genuinely independent or merely a copy, synchronised record or report derived from the same source. Contradictory evidence should be considered alongside supporting material.
Evidence quality and confidenceCounterpart device
A device belonging to another participant in a communication.
Cryptographic hash
A calculated value used to compare data integrity. A matching hash does not by itself establish that content is genuine, accurate or attributable to a particular person.
Evidence quality and confidenceDatabase freelist
SQLite pages marked available for reuse that may retain fragments of previously stored records.
Evidence quality and confidenceDatabase schema
The tables, fields and relationships that define how an application stores structured data.
Deduplication
Identifying records treated as duplicates under a stated rule. Identical text does not necessarily mean the same event. Retain the basis of the decision and the source relationships needed to examine repeated or forwarded communications.
Evidence quality and confidenceDeleted data
Content no longer active or visible; it may or may not remain technically recoverable.
Delivered timestamp
A recorded time associated with delivery to a destination; its precise meaning is application-specific.
Device backup
A logical copy produced through a platform backup service; it is not necessarily a complete file-system acquisition.
What does an encrypted backup password change?Device state
The relevant condition of a device, including power, lock, connectivity, software and encryption status.
Acquisition feasibility and device stateDigital signature
A cryptographic value generated using a private signing key and checked using the corresponding public verification key. Its evidential significance depends on the signature scheme, key and trust context. A valid signature does not, by itself, prove that the content is true or that a particular human knowingly created it.
Evidence quality and confidenceDisappearing message
A message configured to expire after a defined event or period.
Edit flag
A database or service indicator that content has been modified; it may not preserve the original wording.
Encryption
Transformation of information so it is unreadable without the required cryptographic key.
Encryption key
Cryptographic material required to decrypt protected information.
What does end-to-end encryption mean for forensic recovery?End-to-end encryption
Protection designed to make message content readable only at the participating endpoints rather than by intermediaries. Endpoint access, separately retained copies, backups and metadata present distinct evidential questions. The term alone does not describe every storage or backup setting.
What does end-to-end encryption mean for forensic recovery?Epoch timestamp
A numerical time value measured from a specified starting instant. Correct interpretation requires the epoch, units and applicable time convention. A plausible-looking date is not sufficient validation of those assumptions.
Can message timestamps and read receipts be relied upon?EXIF
Metadata commonly embedded in photographs, potentially including device, time and location information.
What can media metadata and provenance establish?Export scope
The users, channels, dates, content classes and fields included in an export, determined by settings, permissions and provider design.
Is a provider export the same as a forensic acquisition?Extraction
A commonly used term for acquired device data; its scope depends on the method and tool.
Factory reset
A process returning a device to an initial state, commonly destroying access to prior encrypted local data.
What can be established when a phone has been reset or reused?False negative
A result that fails to identify the condition being tested when it is present. An omitted or unrecognised record can produce a false negative, but missing data outside the acquired scope is a different limitation.
Can forensic software misinterpret mobile evidence?False positive
A result that incorrectly identifies the condition being tested as present. For example, a processing rule may classify unrelated bytes as a message. The tested condition and reference used to establish the error must be stated.
Can forensic software misinterpret mobile evidence?File system
The structure used by an operating system to organise files, directories and associated metadata.
File-system acquisition
An acquisition providing a broader view of accessible application and system file structures.
What is the difference between logical and file-system extraction?Forensic export
A processed package or report produced by a forensic tool; its evidential value depends on source provenance, scope and validation.
What is needed to review a police or third-party extraction?Forensic image
A preserved copy of a source produced and documented for forensic examination.
Full file-system acquisition
An acquisition intended to obtain a broad file-system view using a particular method. The term does not guarantee every file, key, protected container, deleted item or cloud record is included or readable. Actual scope, errors and exclusions must be documented.
What is the difference between logical and file-system extraction?Group event
A system record of activity such as a member joining, leaving, being removed or changing group settings.
Hash verification
Recalculation and comparison of hash values to test data integrity.
Evidence quality and confidenceiCloud backup
An Apple-hosted device or application backup, subject to account, encryption and retention conditions.
Identifier
A technical value used to distinguish an account, message, device, conversation or record.
iMessage
Apple’s messaging service, distinct from carrier SMS and MMS even though presented in the same application.
Inference
A conclusion reasoned from facts rather than a directly observed record.
Worked example: observation and inferenceIntegrity
The condition of data remaining unchanged relative to a defined reference point, or of changes being identifiable and documented. A hash can support a specific comparison but does not establish the item’s history before that reference point.
Evidence quality and confidenceJournal file
A database companion file used during transactions that may contain recent or superseded data.
Evidence quality and confidenceKeychain
Apple’s protected storage mechanism for credentials, keys and other sensitive application material.
Keystore
A protected facility, commonly on Android, for cryptographic keys and credentials.
Legal hold
An instruction or system control intended to preserve relevant information, subject to its actual scope and implementation.
Linked device
A computer, tablet or other endpoint authorised to access or synchronise a messaging account.
Can linking a device change the evidence?Lockdown record
An Apple pairing record that may permit a trusted computer to communicate with a device, subject to validity and device state.
Logical acquisition
Acquisition of data exposed through supported device services, APIs or backup mechanisms.
What is the difference between logical and file-system extraction?Media provenance
The documented origin, handling and relationship of an image, video, audio file or document to an event.
What can media metadata and provenance establish?Message identifier
An application-generated value used to identify a message within a database or service.
Metadata
Information describing other data, such as time, source, type, size, location or identifier.
What can media metadata and provenance establish?MMS
A carrier multimedia messaging service capable of sending media and longer content.
Multi-factor authentication
An account security process requiring more than one form of verification, such as a password and approval code.
Negative finding
A documented result that specified material was not identified within the sources, scope and methods examined. It is not automatically evidence that the event never occurred or that no other copy exists.
What does “no relevant data found” actually mean?Normalisation
Converting values into a consistent comparison form, such as a common time reference or identifier format. Preserve the original values and document the conversion so that distinctions are not silently lost.
Can message timestamps and read receipts be relied upon?Notification artefact
A system record created when an application presents or receives a notification.
OCR
Optical character recognition: conversion of text shown in an image into machine-readable characters. Recognition errors and missing layout context can affect searches and meaning. Preserve and check the original image where the wording matters.
Evidence quality and confidenceParsed record
A record produced by interpreting source data through software. Its displayed text, times, labels and relationships should be traceable to source fields where material. A parsed record may include derived values or reconstructed content.
Can forensic software misinterpret mobile evidence?Parser
Software that interprets stored data structures and presents them as records or fields. A parser’s labels and omissions depend on its implementation, version and supported structures; the display is not the underlying source itself.
Can forensic software misinterpret mobile evidence?Passkey
A public-key credential used to authenticate to a service. It is not, by itself, a backup-decryption key. Some products combine authentication and recovery features, so the exact implementation and recovery arrangement must be established.
Cloud, backup and account evidencePhysical acquisition
A term traditionally used for low-level storage acquisition; on modern encrypted phones its meaning and availability vary.
Preservation
Actions taken to protect potentially relevant evidence from alteration, loss or destruction.
How should a phone be preserved before forensic examination?Provenance
The documented origin and history of an item or dataset.
What can media metadata and provenance establish?Provider notification
An alert or account event generated by a login, linked session, export or other service action.
Can linking a device change the evidence?Provider-returned data
The representation delivered by a cloud service, which may differ from an original upload through compression, conversion, naming or omitted fields.
Why can cloud media differ from the original file?Quoted reply
A message that includes or references content from an earlier message, sometimes preserving otherwise absent wording.
Raw record
A record in the underlying acquired source representation before a particular processing or presentation step. “Raw” is relative to that step: an acquired file may itself already have been transformed by the device, provider or collection method.
Can forensic software misinterpret mobile evidence?RCS
Rich Communication Services, a modern carrier-supported messaging protocol used by compatible messaging applications.
Reaction
An emoji or other response linked to a message, normally stored as a separate event or record.
Read receipt
An application event indicating that content was marked read; availability and meaning depend on settings and design.
Recall
An application function seeking to withdraw or remove a sent message, commonly leaving a service event.
Recovery key
Cryptographic recovery material required for a protected account or archive; existence of an archive does not imply the key can be reconstructed.
What does an encrypted backup password change?Repeatability
The ability to obtain consistent results when a defined procedure is repeated under substantially the same specified conditions. State what was repeated and the tolerance or expected result; identical output does not alone prove the interpretation correct.
Can forensic software misinterpret mobile evidence?Reproducibility
The ability to obtain consistent findings when a defined examination is repeated under specified changed conditions, such as by another examiner or implementation. State the conditions and terminology used, because technical disciplines can apply this term differently.
Can forensic software misinterpret mobile evidence?Residual data
Information remaining after deletion, expiry or application changes, whether or not readily visible.
Retention policy
Rules determining how long content is retained or deleted; configured retention and actual preserved content must be distinguished.
Secret chat
Telegram’s device-specific end-to-end encrypted conversation mode, distinct from its cloud chats.
Selection bias
Distortion introduced when the material selected for examination or presentation does not fairly represent the relevant source or question. Record selection criteria and consider omitted context, including material inconsistent with the preferred account.
Evidence quality and confidenceSelf-destruct timer
A setting that schedules content to expire after a defined time or event.
Session
An authenticated connection between an account and device, browser or application instance.
SMS
Carrier Short Message Service, distinct from internet-based messaging and Apple iMessage.
Source omission
Relevant information absent from a supplied acquisition or export because of scope, technical failure, filtering or provider behaviour.
What is needed to review a police or third-party extraction?SQLite
A database technology widely used by mobile applications to store structured local data.
Evidence quality and confidenceSynchronisation
The process of updating data across devices or between a device and service.
Synthetic media
Media generated or substantially constructed through computational processes, including generative AI. Synthetic origin, deceptive use and attribution to a person are separate questions; evidence of one does not automatically establish the others.
Can mobile evidence reveal whether an image, voice note or video was AI-generated?Targeted acquisition
Collection limited to defined applications, files, dates or artefact categories rather than the broadest available source.
Tenant
An organisation-specific environment within a cloud service, with its own identities, permissions and configuration.
Third-party image
A device image, backup or forensic export created by another tool or examiner and imported for assessment.
Thumbnail
A reduced-size representation of media that can remain after the original is moved or deleted.
Time-zone offset
The difference between a recorded local time and Coordinated Universal Time.
Timestamp semantics
The meaning of a time field, such as composition, sending, delivery, processing or export. Converting the value to a local time does not establish which event it describes.
Can message timestamps and read receipts be relied upon?Tool validation
A documented assessment that a tool or method is fit for a defined purpose under stated conditions. It should identify the tested functions, versions, expected results and limitations. Validation of one function or configuration is not universal approval of every output.
Can forensic software misinterpret mobile evidence?Transcription
A written representation of speech or other audible content. It is an interpretation of an audio source, not a replacement for it. Record relevant uncertainty, speakers where supportable, timing and the method used.
Independent review of forensic evidenceTranslation
A rendering of meaning from one language into another. Preserve the original and record the translator or method, relevant dialect and material ambiguity. Translation does not establish the original speaker’s identity or the truth of the statement.
Independent review of forensic evidenceTrusted session
An existing authenticated relationship between a device or computer and an account or service.
Unallocated space
Storage not currently assigned to active files; encryption and modern flash management often limit recovery from it.
Unsent message
Application terminology for content withdrawn after sending; implementation and retained records vary.
UTC
Coordinated Universal Time, commonly used as a reference for normalising timestamps.
Vacuuming
SQLite maintenance that rebuilds a database and can remove residual deleted records from its internal free space.
Validation boundary
The precise source, version, method and conditions for which a technical result has been checked; it must not be generalised without support.
Evidence quality and confidenceVerification
A check that a specific item, output or proposition meets stated requirements or agrees with an appropriate reference. Verification of a file hash, field interpretation and complete method are different activities and should be described separately.
Can forensic software misinterpret mobile evidence?WAL file
A write-ahead log used by SQLite that can contain recent database changes not yet merged into the main database.
Evidence quality and confidenceWrite protection
Controls used to prevent or minimise alteration of evidence during acquisition, where technically applicable.
Confidential case review
