What does it mean when data is marked parsed or decoded?¶
title: What does it mean when data is marked parsed or decoded? subtitle: The forensic tool has interpreted stored structures and presented them as a recognisable artefact. slug: what-does-it-mean-when-data-is-marked-parsed-or-decoded series: mobile-extraction-and-reader-reports section: understanding-what-you-have card_type: question_card pathway_order: 9 section_order: 8 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 526 estimated_read_time_seconds: 218 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - parsed data - decoded data - artefacts - validation sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'Cellebrite: Reader overview and limitations' url: https://cellebrite.com/en/series/tip-tuesday/cellebrite-reader-overview/
What does it mean when data is marked parsed or decoded?¶
The forensic tool has interpreted stored structures and presented them as a recognisable artefact.
Script¶
Mobile devices store useful information inside files, databases, logs, caches and application containers.
Those structures aren’t designed primarily for investigators.
A forensic tool has to interpret them.
When data is marked parsed or decoded, it normally means the software has recognised a stored structure and transformed it into a human-readable artefact.
For example, an application database may store an account identifier, a message body, a numeric timestamp, a direction flag, a status value and a reference to an attachment.
The tool reads those fields and presents a chat message showing a sender, recipient, date, text and delivery status.
That is parsing.
Decoding may also involve converting a stored value into a useful meaning.
A timestamp stored as a number becomes a date and time.
Encoded text becomes readable.
A location record becomes coordinates.
An application identifier becomes a recognisable app name.
This work is essential.
Without it, investigators would face large collections of databases and binary files.
But parsed doesn’t mean infallible.
The tool relies on rules created for a particular operating system, application and data structure.
Applications change.
Databases become corrupted.
Fields are reused.
A parser may interpret a value incorrectly or fail to recognise a new version.
Different tools may present the same source differently.
SWGDE recommends validation of evidentially important results by methods such as checking the source data, comparing tools or comparing the parsed result with information visible on the device.
You won’t need the forensic unit to validate every routine contact or system file.
The level of validation should reflect the importance and dispute.
A message that merely provides a lead may be reviewed in the reader.
A single disputed message relied on to prove a serious allegation may need closer source examination.
Look for source information.
Which database, file or path produced the artefact?
Which extraction did it come from?
Was it automatically parsed, manually decoded or carved from a broader data area?
Does the report preserve the original values alongside the interpreted ones?
Reader tools can make source paths visible, but the review environment may not allow the deeper hex or database examination available to the forensic examiner.
The common mistake is:
“The tool decoded it, so the tool has proved what happened.”
The tool has interpreted stored data.
The meaning still needs to be assessed.
A record displayed as a sent message may need status, account and conversation context.
A location artefact may record a place associated with an application rather than the live position of the handset.
Another mistake is:
“It is generated by software, so it is only somebody’s opinion.”
Automated parsing can be repeatable, testable and reliable.
The point is to keep the artefact connected to the source and understand the rule used to interpret it.
A careful description might say:
“The forensic tool parsed this record from the application database and presented it as an outgoing message with this timestamp and account identifier.”
If needed, add:
“The examiner validated the record against the source table.”
Parsed and decoded are descriptions of processing.
They tell you that the report is presenting an interpretation of stored data, not simply displaying a photograph of the phone screen.
Key takeaway
Parsed data is a tool’s structured interpretation of source material. Important findings should remain traceable to that source.
Related questions¶
- What does recovered mean in a mobile extraction?
- What does deleted mean in a mobile extraction?
- Why might two reports from the same device contain different information?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- Cellebrite: Reader overview and limitations