How should I search a mobile extraction report?¶

Start with the investigative question, prepare an identifier list and search iteratively across relevant artefacts rather than relying on one broad keyword.

Build and vary the search set¶

List names, aliases, usernames, numbers, email and account IDs alongside dates, amounts, references, domains, places and distinctive phrases. Begin with specific values, then test country-code, punctuation, spelling and format variants. Search package names or internal identifiers where friendly names may not be stored.

Preserve context and method¶

Review where each hit appears and its surrounding conversation or event; the same text in a contact, notification and message means different things. Record exact terms, options, filters, time-zone display, report version and negative searches. Bookmark relevant results and preserve provenance through an appropriate export.