Why might two reports from the same device contain different information?¶
title: Why might two reports from the same device contain different information? subtitle: The extraction method, device state, tool version, processing and report selection may all have changed. slug: why-might-two-reports-from-the-same-device-contain-different-information series: mobile-extraction-and-reader-reports section: understanding-what-you-have card_type: question_card pathway_order: 7 section_order: 6 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 510 estimated_read_time_seconds: 211 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - report differences - tool version - reprocessing - device state sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: SWGDE Best Practices for Mobile Device Evidence Collection, Preservation, Handling and Acquisition url: https://www.swgde.org/documents/published-complete-listing/18-f-003-swgde-best-practices-for-mobile-device-evidence-collection-and-preservation-handling-and-acquisition/ - title: 'Cellebrite: Creating reports for Reader' url: https://cellebrite.com/en/series/tip-tuesday/different-methods-for-creating-reports-in-cellebrite-reader/ - title: 'Magnet Forensics: Creating and sharing a Portable Case' url: https://www.magnetforensics.com/blog/deep-dive-portable-case-part-one/
Why might two reports from the same device contain different information?¶
The extraction method, device state, tool version, processing and report selection may all have changed.
Script¶
Two reports from the same phone can contain different information without either report necessarily being fabricated or defective.
The first question is whether they came from the same acquisition.
One report may have been created from a logical extraction.
Another may use a later file-system extraction.
A separate backup, memory card or cloud source may have been added.
The device may also have changed between acquisitions.
Phones remain active systems.
Applications update databases.
Messages arrive.
Caches change.
Cloud synchronisation continues.
Wear levelling and garbage collection affect storage.
SWGDE notes that separate extractions from the same mobile device may not produce matching hashes because the device data is volatile and continually changing.
Now check the device state.
Was the phone locked during one attempt and unlocked during another?
Was the passcode available later?
Had the device restarted, updated or lost power?
Was an application open and decrypted during one acquisition but protected during another?
Was the network isolated?
A small change in access or state can affect what the tool can obtain.
Then compare the forensic tools and versions.
One tool may support an application that another doesn’t.
A newer parser may recognise a database structure that the earlier version missed.
Updated software may decode additional data from the same unchanged extraction.
Different tools may also classify the same underlying record differently.
That is why important results may need source validation rather than comparison of friendly labels alone.
Processing settings matter too.
One examiner may have enabled additional carving, recovery, language packs, hash sets or application scripts.
Another may have processed only the standard artefacts.
One report may include recovered or deleted material while the other hides it.
Time display settings can make the same record appear different.
Now check the report scope.
A reader package can contain some or all parsed artefacts.
One report may be limited to a date range.
Another may include only bookmarked items.
Media may have been excluded because of size.
Irrelevant or legally out-of-scope categories may have been removed.
A PDF may contain a narrow selection from a much larger portable case.
The common mistake is:
“Report B has more data, so Report A was wrong.”
Report B may use a broader acquisition, newer parser or wider export.
Another mistake is:
“The records differ, so the evidence can’t be trusted.”
The difference may be explainable and may reveal exactly which acquisition or processing step produced the artefact.
Compare the history.
For each report, record the device and exhibit, acquisition date, acquisition type, source files, tool and version, processing date, enabled settings, report filters and included categories.
Then identify whether the disputed artefact exists in the underlying source.
A careful conclusion might be:
“The later report contains additional application messages because the same file-system extraction was reprocessed using a tool version that supported the revised database.”
Or:
“The reports were created from different acquisitions taken three days apart, during which the device remained active.”
Two mobile reports are products of workflows, not photographs taken outside time.
Understand the workflow before treating a difference as an error.
Key takeaway
Different results don’t automatically mean one report is wrong. Compare the acquisition, processing and report-generation history.
Related questions¶
- What should I check before I start reviewing the report?
- Does the report contain everything that was on the phone?
- What does it mean when data is marked parsed or decoded?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- SWGDE Best Practices for Mobile Device Evidence Collection, Preservation, Handling and Acquisition
- Cellebrite: Creating reports for Reader
- Magnet Forensics: Creating and sharing a Portable Case