Chats and communications
Text messages, app messages, call records, attachments, reactions, deleted remnants when available, and related notification records.
Mobile forensics
Mobile device examinations require more than an extraction.
Phones can contain messages, app databases, media, location related records, account activity, cloud backups, deleted artifacts, and system records that need to be reviewed in context.
Phones and applications
The visible screen is only part of the record.
Mobile forensic work often begins with an extraction, but an extraction is not the final answer. Messages, photographs, videos, application records, browser data, account tokens, location related artifacts, notifications, downloads, and cloud synchronized data can each carry different context.
The same conversation or file may appear in more than one location. A message may exist in an app database, a notification record, a backup, a media folder, a cloud account, or a partial deleted record. The analysis depends on what the device, operating system, application, and extraction method actually make available.
Records reviewed
Mobile evidence is often distributed across apps and accounts.
App databases
SQLite databases, cache records, preferences, logs, session data, downloads, account identifiers, and application specific artifacts.
Photos and videos
Camera records, thumbnails, metadata, edits, exports, shared media, cloud references, and file system dates.
Location related records
Map activity, WiFi and Bluetooth artifacts, app location records, embedded media metadata, and account based location sources when available.
Backups and sync
Device backups, cloud account records, synced messages, shared albums, app data, and differences between local and remote records.
Device activity
Power events, device locks, notifications, application usage, account activity, operating system logs, and extraction limits.
Interpretation
Mobile data can be powerful, but it has limits.
Phone records may show that an event occurred on a device, but not every record identifies who physically held the device or what a person saw. Automated sync, notifications, background activity, cloud behavior, and application design can affect how artifacts are created.
Forensic reporting should explain both the findings and the limits, especially when a conclusion depends on attribution, deleted records, location accuracy, or activity across multiple applications.
Records may help establish
- Messages, calls, media, and attachments
- Application activity and stored records
- Location related artifacts and account records
- Cloud backup or sync differences
- Deleted or partial records when available
Records may require limits
- Attribution to a specific user
- Precision of location data
- Recovery of deleted content
- Meaning of background activity
- Effects of encryption or extraction type
Mobile forensic consultation
Need to understand what a phone actually shows?
Rune Forensics can examine phones, extractions, messages, app records, media, cloud data, location related artifacts, deleted content, and activity timelines for legal and investigative matters.
Request consultation