MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsNIST SP 800-101 Rev. 1 Guidelines on Mobile Device Forensics
NIST SP 800-101 Rev. 1 is the reference most mobile forensic procedures trace back to. It gives the tool classification pyramid, the preservation routine and the acquisition rules that laboratories still follow.
StandardNIST2014 (Revision 1)Final; supersedes the 2007 originalReviewed 2 November 2026
NIST SP 800-101 Revision 1, Guidelines on Mobile Device Forensics, was published in May 2014 by Rick Ayers of NIST, Sam Brothers of US Customs and Border Protection and Wayne Jansen of Booz Allen Hamilton. NIST's page lists it as Final and records that it supersedes the original NIST SP 800-101 of May 2007. The abstract describes the guide as an in-depth look at mobile devices and their technologies and how they relate to forensic procedures, with guidance on validation, preservation, acquisition, examination, analysis and reporting.
Its scope is cellular mobile devices: feature phones, smartphones and tablets with cellular voice, together with their identity modules and associated media. The guide states that it does not prescribe how law enforcement or incident response communities should handle devices, that it names no specific vendors or acquisition products, that it is not a step-by-step guide and that it is not legal advice. It is meant to help organisations write policies and procedures and to prepare examiners for forensically sound work.
Status and Edition
Revision 1 is the current and only revision. The document history on NIST's page shows the Final release on 15 May 2014 with no later draft, and as of 2 November 2026 no Revision 2 has been announced. The guide carries over much of the 2007 text and updates it for the devices of 2014. Readers should keep that date in mind: the devices, operating systems and security features it describes are a generation old even though the process it sets out is still the one taught and used.
The Mobile Device Tool Classification System
Chapter 3 presents a five-level pyramid for comparing extraction methods. As the levels rise the methods become more technical, invasive, time-consuming and expensive, and the risk of altering or destroying data rises with them. The guide warns that once a higher level is used, lower levels may no longer be possible.
- 01Level 1, Manual Extraction
Viewing the device's own screen and recording what is shown, usually with a camera. Nothing deleted can be recovered and every keypress risks changing data. Useless when the screen or keypad is broken.
- 02Level 2, Logical Extraction
Connecting the device to a workstation by cable or wireless and sending commands to which the device responds with its data. The most used level in 2014, needing beginner-level training, with the caution that the connection type itself can change data such as unread messages.
- 03Level 3, Hex Dumping and JTAG
A physical acquisition of flash memory in place, either by loading a boot loader through a flasher box or by using the JTAG test interface through the processor. Reaches deleted data and unallocated space, requires advanced training and produces raw images that need parsing and decoding.
- 04Level 4, Chip-Off
Removing the memory chip from the board and reading it directly. Requires training in electronics and file system forensics and makes lower levels impossible afterwards.
- 05Level 5, Micro Read
Viewing the physical state of memory gates under a high-powered microscope. The most invasive, expensive and time-consuming level, described rather than recommended.
Key Terms
C
- Call and Subscriber Records
- Records held by the network operator, covered in chapter 6 with an example structure in Appendix C. They are obtained from the operator under legal process, not from the device.
I
- Isolation
- Cutting the device off from cellular, Wi-Fi and Bluetooth networks so that it cannot be remotely locked or wiped and so that incoming data does not overwrite evidence. The guide points to the SWGDE mobile phone best practice for the methods and warns that a device sending its own GPS position can reveal the examiner's location.
O
- Obstructed Device
- A device whose contents are blocked by a lock, a password or damage. Chapter 3 describes approaches in general terms; any such access in practice must be lawfully authorised and done within the laboratory's governance.
- On-Site Triage
- Rapid examination at the scene to decide what matters most, which the guide addresses because of laboratory backlogs, with a generic decision tree in chapter 4.
T
- Tangential Equipment
- Cables, cradles, media cards and paired computers. A computer that has a trusted pairing with the device can be more valuable than the device itself.
U
- UICC
- The universal integrated circuit card, commonly called the SIM, which holds subscriber identity and may hold contacts and messages. The guide treats it as a separate source with its own tools and says it should not be removed from the device at seizure.
How a Laboratory Applies It
A generic example: a laboratory receives a locked Android phone seized under a warrant that covers messages only.
- 01Secure and Document the Scene
Chapter 4 asks that the device be photographed as found, including the screen if visible with its time, signal and battery indicators, that accessories, cards and any paired computer be seized with it, and that nothing be removed from the device.
- 02Isolate Before Anything Else
The phone is placed in a shielded container or set to a state that blocks network communication, following the laboratory's written isolation procedure, so that a remote wipe cannot reach it.
- 03Identify the Device and Choose the Tool
Make, model and identifiers are recorded. Chapter 5 asks the examiner to understand what a chosen tool can and cannot acquire from this model and to document the tool version and any patches before starting.
- 04Record the Clock
The device's date and time are compared with a reference clock as soon as it is powered on, because an owner may have set it wrongly and every timestamp depends on this record.
- 05Acquire in the Right Order
If the device is on, internal memory is acquired before the memory card is removed and imaged; if it was off, the card is imaged first. A full extraction is made, but only items within the warrant are reported.
- 06Confirm and Cross-Check
The examiner confirms that the acquisition completed, keeps a second tool ready in case the first fails silently and, where the warrant permits, reviews the device menus on video to confirm the tool's output against what the screen shows.
- 07Report
Chapter 7 lists what a report should carry, including the reporting agency, case identifier, submitter, dates of receipt and report, descriptive list of items, examiner identity, equipment and tools used, a brief description of steps, results and conclusions.
What It Does Not Do and Common Misunderstandings
- It was written in 2014, before encryption by default, hardware-backed key stores and the modern lock-screen protections that make several of its acquisition paths unavailable on current phones.
- It names no vendors or products and prescribes no procedure, so it cannot be cited as authority for any particular tool's output.
- Its cloud section is brief and its treatment of cell site analysis is limited to records structure; those subjects have moved on in SWGDE documents.
- It is a United States federal guideline with no legal standing in India, and it says it is not legal advice.
- Nothing in it authorises unlocking or extracting from a device. Legal authority comes from a warrant, consent or other lawful basis, and advanced access is a governed laboratory step, not a technique to pick from a pyramid.
- It is not a certificate. Laboratory accreditation is assessed against ISO/IEC 17025 by a body such as NABL, and this guide can be a reference in the procedures that assessment examines.
How It Fits With the Other Standards on This Site
This guide is the mobile-specific companion to NIST SP 800-86 and the successor in subject to NIST SP 800-72 of 2004, from which it keeps the preservation, acquisition, examination and reporting structure. Its preservation chapter cites SWGDE directly, and the current SWGDE documents to read with it are the Best Practices for Mobile Device Evidence Collection and Preservation, Handling and Acquisition (18-F-003, version 2.0), the Core Competencies for Mobile Device Forensics (12-F-003, version 2.0) and the Best Practices for Mobile Device Forensic Analysis (version 1.0).
ISO/IEC 27037:2012 covers the same identification, collection and preservation steps in international terms, which is useful when a mobile examination report must be understood abroad. Our Android, iOS and SIM and memory card courses are built on the process in this guide with current devices in the laboratory.
Common Questions
Is the tool classification pyramid still used?
Yes, as a way of talking about how invasive a method is and what it can reach. Vendors' own names for extraction types, such as full file system, do not map exactly onto the five levels, so a report should give both.
Does the guide tell us how to get into a locked phone?
It describes the problem and the categories of approach at a general level. It does not and could not authorise any access; that depends on lawful authority and on the laboratory's governed workflow.
Why does it insist on recording the device clock?
Because every call, message and photo timestamp is relative to it, and an owner can set it to any value. Without the offset from a reference clock, the timeline cannot be defended.
Official sources
- NIST SP 800-101 Rev. 1 publication page (status, authors, supersedes)NIST Computer Security Resource Center
- Full text PDF of NIST SP 800-101 Rev. 1 (May 2014)NIST
- SWGDE published documents, Forensics Committee (mobile device collection and competency documents)Scientific Working Group on Digital Evidence
This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.
Courses that teach it
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cardsGo deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.