How should I search for telephone numbers?¶

title: How should I search for telephone numbers? subtitle: Search several normalised forms and review whether the match is a contact, communication participant, account field or unrelated stored value. slug: how-should-i-search-for-telephone-numbers series: mobile-extraction-and-reader-reports section: searching-and-preserving-results card_type: question_card content_type: core-operational risk_level: normal pathway_order: 17 section_order: 4 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 539 estimated_read_time_seconds: 223 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - telephone number - normalisation - contacts - communications sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'Cellebrite Reader: UFDR Report Viewer for Investigators' url: https://cellebrite.com/en/products/cellebrite-inseyets/reader/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final

How should I search for telephone numbers?¶

Search several normalised forms and review whether the match is a contact, communication participant, account field or unrelated stored value.

Script¶

Telephone numbers appear in mobile evidence in many formats.

A search for one written form may miss another.

Start with the complete number exactly as supplied by the trusted source.

Then create sensible variations.

For a UK number, that may include:

the domestic form beginning with zero;

the international form beginning with plus forty-four;

the international digits without the plus sign;

versions with and without spaces;

versions with hyphens or brackets;

and the significant trailing digits where the report’s search behaviour requires it.

Don't rely only on a short final fragment.

Searching the last six or seven digits can find formatting variations, but it can also produce unrelated numbers.

Use shorter searches to discover candidates, then compare the full value and context.

Consider how applications store numbers.

One database may remove punctuation.

Another may store the country code separately.

A contact record may contain a normalised value alongside the display value.

A messaging application may turn the number into a service-specific account identifier.

Some systems attach a suffix, domain or internal user key.

Search the full application identifier when it is visible.

Review each type of hit.

A number found in a contact record shows that the device or account stored that value, possibly under a chosen label.

A number in a call log may indicate an incoming, outgoing, missed or rejected event.

A number in a message artefact may identify a participant.

A number inside the message body may simply have been discussed.

A number in an account or settings record may be a registered, recovery or verification number.

Those are not interchangeable findings.

Check direction and role.

Was the number the sender, recipient, group participant, contact field, dialled party or content within the message?

Does the artefact identify which account or SIM was used?

Was the record active, recovered or duplicated from another source?

Also search other representations revealed by the device.

The number may be linked to a contact name, WhatsApp account, Signal identifier, Telegram contact or another service.

A conventional call and an application call may appear in separate categories.

The absence of the number from the normal phone log does not exclude communication through an internet service.

Be alert to recycled, shared and transferred numbers.

A telephone number may change subscriber.

A dual-SIM phone may use several lines.

A business number may be shared.

A contact label may be wrong or historic.

The extraction shows how the number appeared in that data source, not who necessarily controlled it at every relevant time.

Keep a search record.

List each form searched, the active filters and the result count.

For a relevant hit, preserve the complete artefact and surrounding conversation or event.

Record the displayed number, any normalised value, account identifier, artefact type, direction, time and source path.

The common mistake is:

“The number appears in the phone, so the suspect contacted its current subscriber.”

The number may sit in an old contact, imported address book, message content or account setting.

Another mistake is to search one spaced format and describe no result as no contact.

Search the number as data, not as the way a person happened to write it on paper.

Then interpret the role of each match before deciding what it proves.

A number match is useful only when you record its format, artefact type, source and role in the record.

Related questions¶

• What alternative names, usernames and identifiers should I search?
• How should I search a mobile extraction report?
• Why might one conversation appear in several places?

Source notes¶

• SWGDE Best Practices for Mobile Device Forensic Analysis
• Cellebrite Reader: UFDR Report Viewer for Investigators
• NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics