As technology continues to progress, one of the most important and most personal items that we almost all seem to carry today are our cell phones. Our cell phones hold our pictures, videos, calendars, contacts and all of our text messages. Volumes could be written on the number of apps that are available to us today. The cell phone is the single largest piece of evidence overlooked in the eDiscovery process.
When we are brought in to consult on nearly any court case, we ask if mobile devices have been included in the preservation order to opposing counsel. They offer more information about a person than any other piece of evidence. That can include:
Cell phone forensics is an ever-evolving science that requires a constant adaptation to technology. We currently support more than 23,000 devices and nearly 5,000 app versions. This data needs to be viewable on an eDiscovery review platform. Our examiners use Cellebrite, MPE+ and IEF to name a few of our tools.
Standard cell phone forensics typically comes in two different flavors. Logical extractions and physical extractions. A logical extraction is the extraction of all of the information found on the operating system. A physical extraction is all of the data found on the operating system for any given device as well as the unallocated space. Unallocated space is simply defined as the area or space on the hard drive of the computer that is available to write data to. The unallocated space is not viewable to the typical computer user and requires specialized computer forensic software/hardware to view and analyze.
When a cell phone allows for a full physical extraction, this opens the doors to deleted photos, videos, text messages to name a few. To learn more about basics of cell phone forensics, please see our iPhone or Android Forensics pages.
Cell phone forensics requires knowledge of each make and model of phone. Knowing the difference between what data can be extracted between an iPhone 4, 4S and 6 can make all the difference to your case.
Do you have an Android phone? Which Android and what operating system is on it? Knowing this determines what can and can not be extracted. Please see our Android Forensics page.
Cell phone forensics is a favorite of our examiners at Decipher Forensics. To find out what data can be extracted from your device, or if you need a certified cell phone expert, give us a call, or fill out our contact form to the right.
We offer many different forms of reports. One of the most common and most popular is the UFED Reader report for mobile devices. Please click below to view our tutorial video on the UFED Reader.