Does the absence of a message, call or application prove it wasn’t there?¶

title: Does the absence of a message, call or application prove it wasn’t there? subtitle: No. Absence may result from the device, acquisition, parser, report scope or search method. slug: does-the-absence-of-a-message-call-or-application-prove-it-wasnt-there series: mobile-extraction-and-reader-reports section: understanding-what-you-have card_type: question_card pathway_order: 12 section_order: 11 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 525 estimated_read_time_seconds: 217 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - absence of evidence - negative result - missing data - limitations sources: - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'Cellebrite: Configuring and reviewing a Reader report' url: https://cellebrite.com/en/ask-the-expert/cellebrite-reader-familiarizing-yourself-with-the-platform/

Does the absence of a message, call or application prove it wasn’t there?¶

No. Absence may result from the device, acquisition, parser, report scope or search method.

Script¶

You search the mobile report for a message, call or application and find nothing.

That is a result.

It isn’t automatically proof that the activity never happened.

A negative result can arise at several stages.

The item may never have existed on that device.

It may have existed but been removed before acquisition.

It may have been overwritten or cleaned by the application or operating system.

It may be stored mainly in the cloud.

It may belong to another device using the same account.

It may sit in an encrypted or inaccessible container.

The extraction method may not have obtained the relevant files.

The files may have been acquired but not supported by the forensic parser.

The report may exclude the relevant date range or data category.

The viewer settings may hide recovered or deleted artefacts.

Or the search may not match the way the information is stored.

A person’s name may not appear in a conversation stored under a telephone number, username, internal account ID or contact identifier.

A telephone number may be stored with a country code, spaces, punctuation or no leading zero.

An application may be identified by its package name rather than the familiar brand.

A call made through an internet messaging service may not appear in the ordinary telephone call log.

So before using absence as evidence, define the expected record.

What exactly should exist if the activity happened?

Which application or system would create it?

Would it be stored locally, in the cloud or on another participant’s device?

How long would it normally remain?

Was that source acquired and successfully parsed?

Now check the report.

Is the full extraction represented?

Are filters active?

Are deleted and recovered records displayed?

Was the relevant application installed?

Are its source files present?

Does the processing log show that the application version was supported?

Would a manual source review or another tool be appropriate?

Then test alternative evidence.

Another participant may hold the message.

A provider may hold account or communication records.

A notification, cache, attachment, thumbnail or database journal may remain even where the main artefact is absent.

The phone may contain evidence that the application was installed or an account was used without preserving the specific communication.

The common mistake is:

“I searched the suspect’s name and got no results, so there was no contact.”

That search tested one representation of the identity in one report.

Another mistake is to make every negative result meaningless by listing endless possibilities.

Absence can become significant.

If the correct device and period were examined, a suitable extraction obtained the relevant application data, the parser supported it, the report was unfiltered and several appropriate searches found nothing, the negative result may properly weaken a claim.

Explain the foundation.

A careful conclusion might say:

“No record of this message was identified in the acquired and successfully parsed application data using these identifiers and search methods.”

That is stronger than:

“The message was never on the phone.”

A negative result is only as good as the system’s opportunity to record, retain, acquire, parse and display the item.

Understand that chain before turning nothing found into nothing happened.

A negative search result becomes meaningful only after you understand what the workflow was capable of finding.

Related questions¶

• Does the report contain everything that was on the phone?
• How do I find out what data was actually extracted?
• What should I ask the digital-forensics unit before relying on the report?

Source notes¶

• NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
• SWGDE Best Practices for Mobile Device Forensic Analysis
• Cellebrite: Configuring and reviewing a Reader report