Mobile evidence guidance
What if two participants’ phones contain different chats?
Differences do not automatically establish fabrication. Deletion, retention, edits, synchronisation, device migration, time zones and application versions must be tested before inconsistencies are characterised.
Potential evidence sources
Where relevant records may exist.
- Both devices and their message databases
- Backups from each participant
- Exports and screenshots
- Shared attachments and file hashes
- Group-participant records
- Linked desktop artefacts
Decision factors
What materially changes the prospects.
- 01Acquisition date and method for each device
- 02Deletion and edit history
- 03Local time settings
- 04Application versions
- 05Account migration and synchronisation
Evidential limitations
What must not be overstated.
One device may legitimately retain more than another
Exports can omit service events or attachments
Comparison requires normalisation of identifiers and time
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
