Mobile evidence guidance
What can media metadata and provenance establish?
Metadata and provenance can help establish where a photograph, video, voice note or document came from, when it was created or handled and how it relates to a conversation. Neither metadata nor visual content should be interpreted in isolation.
Potential evidence sources
Where relevant records may exist.
- Original media file
- EXIF and container metadata
- Application database and attachment identifiers
- File-system creation, modification and cache records
- Cloud, backup and export history
- Matching copies on counterpart devices
Decision factors
What materially changes the prospects.
- 01Whether the original file is available
- 02Effects of export, messaging, editing or transcoding
- 03Device clock and time-zone settings
- 04Hash or perceptual similarity between copies
- 05Relationship to the surrounding conversation
Evidential limitations
What must not be overstated.
Metadata can be stripped, transformed or deliberately altered
File-system times may record copying rather than original creation
A matching image does not by itself establish who sent it or why
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
