What exactly is a mobile phone extraction report?¶
It is a presentation of data acquired from one or more mobile evidence sources, interpreted by forensic software and selected for review.
It is not a live copy of the phone¶
Sources can include handset storage, SIM, memory card, backup, app container and cloud account. An acquisition method obtains accessible data; software then parses files and databases into recognisable messages, calls, media, accounts and other artefacts.
Reports differ in scope and purpose¶
A searchable reader may contain broad or selected parsed data, while a PDF, spreadsheet, bookmark export or examiner narrative can be narrower. Important interpretations remain traceable to the acquired source for validation or reprocessing. Establish which sources, methods, limitations and selections produced the item you received.
Key takeaway
Treat the report as a review layer created from acquired and processed sources, and know its scope before relying on presence or absence.
