Smartphone forensics

Sometimes. Deleted records often remain in the database until the space is reused. Whether they survive depends on the app, the device and how much has happened since deletion.

Analysis takes place on the secured working copy in the permanent examination rooms at the registered office in Krefeld, Germany. Devices are handed over in person or sent by insured carrier; by prior arrangement, processing in Munich is also possible. Where the technical conditions allow it, the acquisition itself can also be carried out at the client’s premises or at the location of the item; unavoidable changes to a running system are documented with reasons.

Whether an expert report is used in proceedings, and what evidential value it carries, is decided by the competent court or investigating authority. Our examinations are documented so that third parties can review them: recorded handover, cryptographic hashes, described methods and a clear separation between technical finding and assessment. A binding assurance of later admissibility cannot be given.

Not guaranteed. Whether deleted messages, call logs or chats can be recovered depends on the device, the type of acquisition, the encryption and whether the relevant storage areas have already been overwritten. Modern smartphones with file-based encryption make recovery considerably harder. What is possible is the analysis of remaining database remnants, backups and synchronised copies. Recovery can never be promised – only examined case by case.

Sources: NIST SP 800-101 Rev. 1 – Guidelines on Mobile Device Forensics

No. A technical examination can establish whether defined indicators – known spyware signatures, suspicious profiles, unusual permissions or suspect network connections – are present at the time of examination. A definitive exclusion is technically impossible, because methods and device generations differ in reach. The result is therefore always a statement about the indicators examined at that point in time, not a guarantee for the future.

Sources: NIST SP 800-101 Rev. 1 – Guidelines on Mobile Device Forensics · SWGDE – published best-practice documents

Do not keep using the device, do not install supposed cleaning or anti-spyware apps, do not factory-reset, do not update the system and do not make test calls. All of this can overwrite traces or alert the attacker. The device should be disconnected from the home network but not switched off without consultation – depending on the model and lock state, a powered-off device is harder to acquire later. Note the time suspicion arose, the observed anomalies and any steps already taken.

Sources: NIST SP 800-101 Rev. 1 – Guidelines on Mobile Device Forensics