What should I check before I start reviewing the report?¶

Spend a couple of minutes making sure you know which device, extraction and view you are actually looking at before you start searching.

It saves a surprising amount of confusion later.

First, identify the package¶

Check:

• case and exhibit number;
• handset make/model;
• extraction or report identifier;
• acquisition date;
• report creation date;
• whether SIM, memory card, backup or cloud data are separate;
• whether another extraction or earlier report exists.

A report from the right case but the wrong handset is an obvious problem. A report from the right handset but an earlier partial extraction can be just as important.

Check the examiner notes¶

Look for anything that says:

• acquisition was partial;
• the device was locked;
• an application was unsupported;
• parsing failed;
• data was encrypted;
• cloud material was not acquired;
• timestamps need special treatment; or
• a second method was used.

Those notes tell you where the report may have limits before you rely on a missing result.

Check what the viewer is currently showing¶

Reader software may have filters for:

• date ranges;
• application;
• artefact categories;
• bookmarks;
• deleted/recovered items;
• media;
• translations;
• time zone.

If you later say “there were no Telegram messages”, that note may suddenly matter.

Make a short pre-review note¶

You do not need an essay.

Something like this is enough:

“Reviewing SA/12, report UFDR-2026-0914-A, UTC display. WhatsApp and SMS included. Recovered items visible. Cloud backup not acquired.”

Now another investigator can understand what your later searches actually covered.

Does the report contain everything that was on the phone? explains why these scope checks matter.

The practical point is: know which package and settings you are reviewing before treating either a hit or a missing result as evidence.