Mobile evidence guidance
What is needed to review a police or third-party extraction?
Request the fullest lawfully available source package, acquisition notes, hashes, tool and version details, error logs, date scope and the report being challenged. Selected screenshots alone often cannot resolve completeness or interpretation.
Potential evidence sources
Where relevant records may exist.
- Original acquisition or compatible export
- Integrity and custody records
- Report, schedules and exhibits
Decision factors
What materially changes the prospects.
- 01Available source depth
- 02Missing attachments
- 03Whether parser output can be tested against native records
Evidential limitations
What must not be overstated.
A reader package may be a processed subset
Review cannot recreate material omitted at acquisition
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
- SWGDE 18-Q-001-2.1: Minimum Requirements for Testing Tools Used in Digital and Multimedia Forensics, version 2.1, 7 March 2024
Testing guidance, not certification or endorsement of the practice.
General methodology · Documentation checked
Confidential case review
