How should I search for dates, amounts and reference numbers?¶
title: How should I search for dates, amounts and reference numbers? subtitle: Search the value in the forms the application may store or display, then review the surrounding event rather than the isolated match. slug: how-should-i-search-for-dates-amounts-and-reference-numbers series: mobile-extraction-and-reader-reports section: searching-and-preserving-results card_type: question_card content_type: core-operational risk_level: normal pathway_order: 20 section_order: 7 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 521 estimated_read_time_seconds: 216 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - dates - amounts - reference numbers - search strategy sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'Cellebrite Reader: UFDR Report Viewer for Investigators' url: https://cellebrite.com/en/products/cellebrite-inseyets/reader/ - title: 'Magnet Forensics: Portable Case for evidence review' url: https://www.magnetforensics.com/blog/the-power-of-portable-case-unleashing-evidence-discovery-for-all-investigators/
How should I search for dates, amounts and reference numbers?¶
Search the value in the forms the application may store or display, then review the surrounding event rather than the isolated match.
Script¶
Dates, amounts and reference numbers are often more distinctive than names.
They can connect messages, notes, documents, browser activity, photographs and application records around the same event.
But they may be stored or displayed in several forms.
Start with dates.
Search the written forms likely to appear in human-created content.
For 25 July 2026, that might include:
25/07/2026;
25-07-26;
25 July;
July 25;
and a distinctive time where known.
Be careful with ambiguous formats.
07/08/2026 may mean 7 August or 8 July depending on the system and user.
A global text search will usually find dates written inside messages, documents and notes.
It may not find artefacts whose time is stored as a numeric timestamp and only converted for display by the forensic tool.
For those records, use the reader’s date or timeline filters as well as keyword search.
Confirm the displayed timezone before relying on the window.
Amounts also vary.
Search the value with and without the currency symbol.
Try commas, decimal points and whole-number forms where appropriate.
For example, £1,250.00 may appear as 1250, 1,250, 1250.00 or in a minor-unit field such as pence inside an application database.
A broad search for 50 will usually be too noisy.
Use surrounding wording, currency, payee, date or reference to narrow the result.
Remember that an amount can appear in several roles.
It may be a payment, balance, price, message content, spreadsheet entry, screenshot, notification or application configuration.
The matching number alone does not prove a transaction happened.
Reference numbers can be especially valuable.
Search the complete value first.
Then consider versions without spaces, hyphens or prefixes.
A bank reference, booking code, parcel number, invoice number or case identifier may be copied across messages, emails, browser pages, screenshots and documents.
Preserve capitalisation and punctuation in your notes even if the search tool ignores them.
Partial searches need caution.
A long reference may be truncated in a notification or screenshot.
Searching a distinctive central or final segment may reveal it.
But a short fragment can produce unrelated matches.
Compare the full value wherever possible.
Review nearby records.
A payment reference in a chat may connect the conversation to a banking notification.
A booking number in a screenshot may connect to browser history and an email attachment.
A date and amount together may be more meaningful than either alone.
Use combinations carefully.
Some viewers support filters and multiple terms.
Others search only literal text.
Record the exact method so another person can repeat it.
The common mistake is:
“I found the amount on the phone, so the payment occurred.”
The record may only show that the amount was discussed or displayed.
Another mistake is to search a displayed date as text and miss records stored only as timestamps.
Use both keyword search and date filtering.
A useful finding records:
the value searched;
the variations used;
the artefact type;
the surrounding content;
the displayed and source time;
and any linked account or transaction identifier.
Numbers connect evidence well.
They don't explain themselves.
Use the surrounding artefact to establish what the date, amount or reference actually represents.
Key takeaway
Dates, amounts and references are powerful because they connect records across systems, but formatting and context can change how they appear.
Related questions¶
- How should I search a mobile extraction report?
- Why might one conversation appear in several places?
- How do I record where an artefact came from?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- Cellebrite Reader: UFDR Report Viewer for Investigators
- Magnet Forensics: Portable Case for evidence review