Can forensic software misinterpret mobile evidence?

Follow the chain from source to display

An acquisition obtains a particular body of data. A parser interprets structures within that data. A report presents selected results. A limitation at any stage can affect what the reader sees. Identify the source, processing version, settings, errors and selection criteria relevant to the disputed finding.

Ask a specific validation question

For a disputed message, useful questions include: Which source record supports the displayed wording? What does this timestamp field represent? How was the account identifier resolved? Is the “deleted” label a source state, a reconstruction or a software category? Is the record complete enough to support the asserted relationship?

These questions are more informative than asking whether a product is generally “court approved”. A product name alone does not establish reliability for an individual artefact.

Use comparison carefully

Reprocessing may help identify differences, but agreement between two displays is not automatically independent confirmation. They may rely on the same export, assumptions or underlying component. Record whether a check uses source-level inspection, a known-answer test, another implementation or genuinely separate evidence.

Explain unresolved differences

A discrepancy may reflect configuration, software version, extraction scope, filtering or an interpretation error. Preserve the earlier output and explain what changed. Do not silently replace a result or choose the output that best supports the preferred account.

The conclusion is tied to the specific finding checked. Where the available source cannot resolve a material interpretation, say so and explain the effect on the opinion.