Mobile Phone and Tablet Forensic Examination

Because so much personal and business communication happens on mobile devices, the phone is often what shows the timeline of an incident most clearly.

Mobile operating systems store data in encrypted, protected form, so the same method does not work on every device. The approach must be chosen according to make, model, OS version and lock state.

• Assessment of the device's condition and the access method
• Data extraction using the appropriate method (logical, file system or physical)
• Messaging records and in-app communications
• Photos, videos and audio recordings analysed with their metadata
• Call logs, contacts and account information
• App data and install/uninstall traces
• Internet history and user activity
• Assessment of deleted data where technically accessible

A classic disk image is not always possible on mobile devices, so we first assess the device and choose the least intrusive extraction method available.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Extraction and verification: the device is isolated from networks, data is extracted with the appropriate method and the hash value of the extracted dataset is recorded.
3. Analysis: messages, media, call and app data are examined on the extracted dataset; no examination is performed on the original device.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment. Locked or hard-to-access devices may take longer;

Organisations handling commercial disputes or internal investigations, law firms, and individuals involved in family or employment law matters.