Mobile evidence guidance
What does a forensic tool's deleted label mean?
It is a processing classification, not a conclusion about who deleted a record or why. The examiner must inspect the source structure, schema and context, and distinguish fragments from complete records.
Potential evidence sources
Where relevant records may exist.
- Main database and companion files
- Parser output and version
- File-system and transaction context
Decision factors
What materially changes the prospects.
- 01Record completeness
- 02Database reuse
- 03Independent corroboration
Evidential limitations
What must not be overstated.
A deleted flag does not prove deliberate destruction
Fragments may lack reliable sender, time or conversation context
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
- SWGDE 18-Q-001-2.1: Minimum Requirements for Testing Tools Used in Digital and Multimedia Forensics, version 2.1, 7 March 2024
Testing guidance, not certification or endorsement of the practice.
General methodology · Documentation checked
Confidential case review
