Mobile Device Forensics

What it is and why it matters

A phone is a camera, a diary, a wallet, a map and a messaging hub in one pocket. For an investigator that makes it the richest single source of evidence in most cases, and also the hardest. Phones are always on, always connected and encrypted by default. They change their own data every minute and they can be wiped from the other side of the world.

Mobile device forensics is the practice of taking a phone under lawful authority, stopping it from changing, extracting as much of its storage as the device and the law allow and then reading the hundreds of SQLite databases, property lists and media files inside. The depth of extraction varies a great deal between models, operating system versions and the lock state the phone was found in.

The discipline is tool-heavy, but the tool is not the examiner. Understanding where an app keeps its data, what a timestamp means in that database and why a record appears twice is what turns an extraction into evidence that stands up.

Types of digital evidence

Messages and Chats
SMS, MMS and chat application databases such as WhatsApp, Telegram and Signal, with their attachments, read receipts and deleted-record remnants where recoverable.
Call and Contact Records
Call logs with duration and direction, contact lists with linked accounts and the metadata that shows how often two people communicated.
Location Data
GPS fixes in photos, map application history, cell and Wi-Fi location caches and system records of significant places.
Photos and Videos
Media files with EXIF metadata, thumbnails in cache folders that outlive the originals and the databases that record when each item was taken, edited or shared.
Application Data
Databases, preference files and caches for every installed app, from banking and payment apps to social media and dating apps.
Account and Cloud Tokens
Signed-in accounts, authentication tokens and sync settings that show which cloud services hold more data and may be reachable with separate authority.
System Logs and Usage Records
Device unlock events, app usage statistics, Wi-Fi connection history, battery and power logs that prove the phone was active at a given time.
SIM and Network Identifiers
IMEI, IMSI, ICCID and phone numbers that link the handset to a subscriber and to operator records.

Devices and data sources

Android smartphones and tablets from many manufacturers and OS versions
iPhones and iPads
Feature phones and basic handsets still common in India
SIM cards and eSIM profiles
Removable microSD cards
Local backups on computers, such as iTunes or Finder backups and Android backup files
Cloud accounts linked to the device, reached only with separate legal authority
Smartwatches and other paired wearables that mirror notifications and health data
Chip-off and ISP dumps from damaged or older devices

How an examination runs

The order matters. Each step protects the one after it.

01
Lawful Authority and Scope
Confirm the warrant, consent or corporate authority that covers the device and any linked accounts. The scope decides what may be extracted and examined.
02
Seize and Isolate
Photograph the device and its screen state. Put it in airplane mode if unlocked and accessible, or in a Faraday bag, so that no remote wipe, new message or lock command reaches it. Decide whether to keep it powered, because an unlocked or after-first-unlock device can lose access if it switches off.
03
Document the Device
Record make, model, IMEI, OS version, lock type and any damage. Note the lock state, since before-first-unlock and after-first-unlock states give very different access.
04
Choose the Extraction Level
Start with the least invasive method that answers the questions. Logical and backup extractions first, full file system where the tool supports the device, physical and hardware methods only where justified and authorised.
05
Extract and Hash
Run the extraction, record every prompt, error and tool version and hash the resulting container. Repeat with a second method where a single extraction misses known data.
06
Parse and Verify
Let the tool decode the data, then check key findings against the raw databases. Confirm timestamp formats and time zones before reading any date.
07
Report
Present messages, locations and media with their source paths and record numbers, and say plainly what the extraction level could not reach.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Logical Extraction: Data obtained through the operating system's own interfaces and backup services. Fast and safe, but it does not include deleted records or protected app data.
Full File System Extraction: A copy of the user data file system with its databases, caches and logs. It needs elevated access that vendor tools provide for supported devices.
Physical Extraction: A bit-level copy of the storage partitions. On modern encrypted phones it returns ciphertext unless the keys are also available.
BFU and AFU: Before First Unlock and After First Unlock. After the first unlock since boot, many encryption keys stay in memory, so an AFU device yields far more than a BFU one.
File-Based Encryption: The Android scheme where each file is encrypted with keys tied to the user's credential and the device hardware. iOS uses a similar per-file Data Protection system.
SQLite and WAL: The database format used by most mobile apps. The write-ahead log (WAL) file can hold recent changes and deleted rows that the main database no longer shows.
Faraday Bag: A shielded pouch that blocks radio signals so a seized phone cannot receive a remote wipe or a new message that overwrites evidence.
Secure Enclave and TEE: Hardware security processors in iPhones and Android devices that hold encryption keys and enforce passcode limits. They set the ceiling on what any extraction can reach.
IMEI: The International Mobile Equipment Identity, a serial number that identifies the handset itself on the network.

Challenges and limits

What makes it hard

Default encryption and hardware key storage mean that a locked device may give nothing without a lawful route to the passcode
Each OS update changes database schemas, paths and security, so tool support lags behind new releases
Thousands of apps store data in their own ways and tools decode only the common ones, leaving the rest to manual work
Remote wipe, auto-delete and disappearing messages can remove evidence before or during seizure
Cloud data outside the handset needs separate authority and may be under another country's law
Tools sometimes mislabel timestamps or merge records, so findings used in court need checking at the database level
Damaged, water-logged or burnt devices need hardware recovery that is slow, expensive and not always possible

Keeping the evidence intact

Isolate the device from networks before anything else and record how it was isolated
Document the lock state and every interaction with the screen, including any passcode entry under authority
Hash every extraction container immediately and keep the tool logs with it
Prefer methods that do not write to the device, and where a tool must install an agent, record what it installed and why
Verify important records against the raw database rather than relying on a decoded view

Standards and legal considerations

NIST SP 800-101 Rev. 1
Guidelines on Mobile Device Forensics. Explains device characteristics, the levels of extraction and the handling of phones from seizure to reporting.
Read the guide
ISO/IEC 27037:2012
The general rules for identifying, collecting and preserving digital evidence, which apply to phones as much as to computers.
Read the guide
SWGDE Best Practices
SWGDE publishes practice documents on mobile device evidence collection, examination and acquisition that labs use to shape procedures.
Read the guide
NIST SP 800-72
The earlier guideline on PDA forensics. Historical now, but it shows how the discipline grew out of handheld computer examination.
Read the guide

In practice

Deleted WhatsApp Chats
A complainant says threats were sent and then deleted. A full file system extraction of the suspect's Android phone recovers the message database and its write-ahead log, where several unsent and deleted rows remain with timestamps that match the complaint.
An Alibi Checked Against the Phone
A person claims to have been at home all evening. Photos in the gallery carry GPS coordinates elsewhere, the map application history shows a route and the Wi-Fi connection log shows the home network was left at 7 pm and rejoined at 11 pm.
A Phone Found Switched Off
A locked, powered-off iPhone is seized. The examiner records that it is in a before-first-unlock state, documents the model and OS version and reports which extraction routes exist for that combination rather than attempting an unsupported method.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsIntermediateDCMFE

MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone casesIntermediateDCMFE

MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cardsBeginnerDCMFE

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

Standards for this area

Careers that use it

Questions people ask

Can a locked phone be examined?

Sometimes. It depends on the model, the OS version, the lock state and the lawful routes available to the lab. Some combinations allow a full file system extraction, others allow very little. A good examiner states what is possible before starting rather than promising results.

Why does the same phone give different results with different tools?

Tools support different devices, decode different apps and handle deleted records differently. Labs often run two tools and compare, and check anything important in the raw database.

Is data on the SIM card still useful?

Less than it was. Modern phones store contacts and messages in the handset, but the SIM still carries identifiers that link the phone to a subscriber and sometimes location and message remnants.

What about the cloud account?

Cloud data such as backups, photos and email can be larger than what is on the phone, but it belongs to a separate legal process and often to a provider in another country. Tokens found on the phone show which accounts exist, not permission to open them.