Mobile device forensics
Phones hold messages, location history, photos and app data that often matter more than a laptop in an investigation. Collecting it takes care: the wrong step can alter the evidence or lock the device for good.
What we do
- Evidence handling steps
- Spyware indicator checks
- Timeline building
- Chain of custody
- Device preservation advice
- Findings summary
- Coordination with counsel
Our team works with Magnet Forensics, Oxygen Forensics and MSAB, and has experience with open-source tools such as iLEAPP and the Mobile Verification Toolkit, used to check phones for signs of spyware. We document each step and hash what we collect so the result can be reviewed later.
This group links to our Cybersecurity service and to the forensics and mobile threat defense groups. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Magnet Forensics
- Oxygen Forensics
- MSAB
- iLEAPP
- Mobile Verification Toolkit
- Cellebrite
Platforms and practices
- iOS and Android evidence collection
- Chain of custody records
- Hash verification of images
- Messaging app data parsing
- Location and timeline analysis
- Spyware indicator checks
- Encrypted backup handling
- Company-owned device wipe and preservation
- Written findings for counsel
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Mobile device forensics for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreDisaster Recovery Planning
Know how long you can be down, and prove you can come back before the day you must.
Learn moreWhere this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you recover deleted messages from a phone?
Sometimes. It depends on the phone model, the operating system version, whether the device is locked, and how the app stores data. Some data can be recovered and some cannot. We tell you what we collected and what we could not reach, and never promise a result in advance.
Should we turn the phone off or wipe it if it may be evidence?
Do not wipe it, and do not keep using it. Switching it off can lock some phones in a state that is harder to read. Put it in airplane mode if you are told to, keep it charged, and call us before anyone browses it. If a lawsuit is possible, ask counsel about preservation.
Can you check whether a phone has spyware on it?
We can look for known indicators with tools such as the Mobile Verification Toolkit. A clean result means no known signs were found, not that the phone is proven safe, because new spyware may not have indicators yet. We explain the limits in the written findings.
Can we collect data from an employee's personal phone?
That depends on your policy, the employee's consent and local law. A company-owned device is simpler. For personal devices, involve counsel first, because privacy and employment rules may limit what can be collected.