Mobile evidence guidance
What does an encrypted backup password change?
A retained backup and a usable backup are different things. Required passwords, keys or recovery mechanisms must be available, and the backup must include the relevant application and dates.
Potential evidence sources
Where relevant records may exist.
- Original backup files and manifest
- Documented backup settings
- Authorised recovery material held separately
Decision factors
What materially changes the prospects.
- 01Backup date and platform
- 02Encryption configuration
- 03Whether content synchronised outside the backup
Evidential limitations
What must not be overstated.
A password does not restore records never backed up
Do not overwrite an existing backup or restore the evidence phone
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Signal Secure Backups
Optional encrypted backups; restoration support is not proof of forensic acquisition support.
Platform documentation · Documentation checked
- Apple iCloud data protection
Configuration changes encryption and key availability.
Platform documentation · Documentation checked
- What iCloud backs up
Synchronised content and device backups are distinct.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
