Mobile Extractions Technical Explainer

Does the report contain everything that was on the phone?¶

Usually not.

A mobile extraction report is a view of data that was successfully obtained, interpreted and included in the package you have been given. That is not necessarily the same thing as everything that existed on the handset.

This matters most when somebody says:

“There are no messages with X.”

Before relying on that, make sure the relevant data could actually have appeared in the report.

Think of it as several filters¶

Phone / sourceWhat existed?Device storage, apps, SIM, memory card, backups and cloud material may be separate.

AcquisitionWhat could be obtained?Lock state, encryption, method and device support affect access.

ProcessingWhat could the tool understand?Databases and files need to be parsed or decoded correctly.

ReportWhat were you actually given?Date ranges, categories, bookmarks and viewer filters may narrow the result again.

If data drops out at any of those stages, it may never appear in your reader.

A missing result can mean several different things¶

Suppose you search for a WhatsApp conversation and find nothing.

That could mean:

the conversation never existed;
the app data was not accessible;
the relevant database was acquired but not successfully parsed;
the messages had already been deleted or expired;
the material lived in a backup or linked source that was not acquired;
the examiner supplied a narrower report;
or your current viewer filters are hiding it.

Those are very different explanations.

Positive findings and negative findings need different caution¶

If you can see a clear active message artefact with a source reference, you can usually work with that finding.

If you are relying on absence, first ask what population has actually been searched.

That is why how to find out what was actually extracted is so useful when a missing result matters.

What should you check?¶

Before saying “it isn't on the phone”, establish:

which device and related sources were acquired;
whether the acquisition was complete, partial or failed;
whether the relevant application data was accessible;
whether the tool successfully interpreted it;
whether the report includes the relevant dates and categories;
whether deleted/recovered material is visible; and
whether any viewer filters are active.

The practical point is: the report can be excellent evidence without being a complete copy of everything that ever existed on the phone. Know what is inside your search before relying on what is not there.