Mobile evidence guidance
Why can cloud media differ from the original file?
Services may resize, compress, rename or convert uploaded files and expose different metadata. A different hash therefore does not alone prove tampering; compare like representations and document the collection path.
Potential evidence sources
Where relevant records may exist.
- Original file where available
- Provider-returned file
- Message attachment identifiers and metadata
Decision factors
What materially changes the prospects.
- 01Upload versus download representation
- 02File conversion
- 03Collection interface and date
Evidential limitations
What must not be overstated.
Missing metadata may reflect processing
A thumbnail cannot establish every property of the original
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
