How should I deal with duplicated results?¶

title: How should I deal with duplicated results? subtitle: Group likely copies, identify the best source and retain any duplicate that adds provenance, status or context. slug: how-should-i-deal-with-duplicated-results series: mobile-extraction-and-reader-reports section: searching-and-preserving-results card_type: question_card content_type: core-operational risk_level: normal pathway_order: 22 section_order: 9 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 473 estimated_read_time_seconds: 196 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - duplicates - deduplication - artefacts - review sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'Cellebrite Reader: UFDR Report Viewer for Investigators' url: https://cellebrite.com/en/products/cellebrite-inseyets/reader/ - title: 'Magnet Forensics: Creating and sharing a Portable Case' url: https://www.magnetforensics.com/resources/case-collaboration-with-magnet-ief-how-to-create-a-portable-case/

How should I deal with duplicated results?¶

Group likely copies, identify the best source and retain any duplicate that adds provenance, status or context.

Script¶

Duplicate results are common in mobile reports.

The same underlying event may be represented by several artefacts, several parser views or several evidence sources.

Don't try to solve the problem by deleting items from the original report.

Instead, group and explain them.

Start by deciding whether the results are true duplicates.

Compare:

message or event identifiers;

participants;

direction;

timestamps;

content;

attachment references;

application account;

source file;

and extraction source.

Two records with similar text are not automatically the same event.

A repeated message may have been resent.

A user may have copied and pasted the same wording.

An edited message may preserve an earlier version.

A notification may show only a preview of the main message.

Where the identifiers and context match, classify the records as likely traces of the same event.

Then identify the best primary artefact.

Prefer the record that provides the clearest source, complete content, participants, status, time and application context.

That may be the active application database record rather than a notification preview or recovered fragment.

Keep the other traces where they add something.

A database journal may support that the record existed earlier.

A notification may help show what was displayed.

A backup may show the item was present at a particular point.

A second participant’s device may independently corroborate the communication.

Don't treat several parser outputs from the same source database as independent corroboration.

The tool may be displaying one row under several categories.

Check the source path and record identifier.

Use tags or comments to group the results.

For example:

“Primary artefact — active chat database.”

“Supporting trace — matching notification.”

“Duplicate parser view — same source record.”

“Separate source — recipient device.”

This reduces repeated review without losing provenance.

When exporting, decide what the reader needs.

A focused evidential package might include the primary artefact and one or two supporting traces with an explanation.

Exporting twenty near-identical copies can obscure the point.

But keep a record of how many hits were reviewed and why others were treated as duplicates.

Be careful with automated deduplication.

A tool may group items by hash, text, identifier or other rule.

Identical hashes can show identical file content.

They don't always show identical context.

The same image may appear in two conversations, on two devices or at different times.

Those locations and associations may matter even where the file is identical.

The common mistake is:

“These are duplicates, so the extras are worthless.”

Another is:

“There are thirty hits, so there were thirty events.”

The correct count depends on the underlying identifiers and sources.

A useful review note states:

which artefact was selected as primary;

which records were grouped with it;

which fields supported the grouping;

which duplicates added independent context;

and whether any uncertainty remains.

Deduplicate your analysis.

Don't erase the evidence trail that explains how you did it.

Deduplication is an analytical decision, not a reason to delete evidence from the source package.

Related questions¶

• Why might one conversation appear in several places?
• How do I preserve a useful result from a reader report?
• How do I record where an artefact came from?

Source notes¶

• SWGDE Best Practices for Mobile Device Forensic Analysis
• Cellebrite Reader: UFDR Report Viewer for Investigators
• Magnet Forensics: Creating and sharing a Portable Case