Mobile evidence scenarios
Start with
what happened.
Most instructions begin with a problem, not a technical term. These scenarios identify the evidence sources, immediate actions and interpretation risks that commonly matter.
An employee deleted WhatsApp before resigning
The immediate issue is preservation across the company phone, employee-held devices, backups, linked computers and recipients, followed by a proportionate assessment of what deletion can actually be proved.
Review the scenario 02Screenshots were supplied without the phone
Screenshots can be assessed for consistency, but the evidential gap must be identified. The source device, original files and underlying application records remain the priority.
Review the scenario 03An independent review of a police extraction is required
The review should begin with the complete extraction, acquisition logs, device details, schedules and the propositions the police material is said to support.
Review the scenario 04A fraudster impersonated a family member
The examination may address cloned profiles, account compromise, voice notes, payment instructions, contact discovery and the victim’s exposure, while distinguishing technical findings from speculation about the offender.
Review the scenario 05A phone was factory reset before examination
The handset may no longer retain accessible historic data. The investigation should pivot promptly to backups, cloud accounts, linked devices, recipients and contemporaneous exports.
Review the scenario 06Two chat exports contain different messages
Differences must be normalised by account, device, application version, export method, time zone, deletion and acquisition date before manipulation is inferred.
Review the scenario 07WeChat conversations were recalled or cleared
The examination should distinguish message recall, local deletion, app-data clearing and account migration, then test desktop clients, media, backups and counterpart devices.
Review the scenario 08Signal messages disappeared before the device was seized
The inquiry should document configured timers and identify related attachments, notifications, linked desktops and recipients, while accepting that expired content may not be recoverable.
Review the scenario 09A phone was used by more than one person
Device ownership is not the same as authorship. The examination should reconstruct access, user activity, account sessions and surrounding conduct for the relevant times.
Review the scenario 10A messaging application was deleted before examination
Deletion changes the evidence landscape but does not always end the inquiry. Media, notifications, backups, linked computers and recipients may still preserve relevant material.
Review the scenario 11A device has surfaced and must be preserved
The priority is to maintain its present evidential state, record custody and avoid well-intentioned actions that alter or remotely expose the data.
Review the scenarioConfidential case review
