Service
Smartphone forensics
What is examined
- Messages, call logs and contacts, including deleted remnants in databases
- App databases, caches and account data
- Media files with their embedded metadata
- Location and sensor data, backups and paired devices
How the examination is carried out
- 1.Selection of the extraction method appropriate to model, firmware and lock state
- 2.Logical extraction or, on supported devices, a full file system extraction, with hashes recorded
- 3.Analysis of the extraction, including database records marked as deleted
- 4.Manual verification of automatically parsed results
Full file system extraction on supported devices
On suitable smartphones and tablets we can carry out a full file system extraction (FFS). It preserves the file system data that is accessible with the method used. Depending on the device and the data, this can include app databases, system files, logs and other technical traces.
Whether this method is possible depends, among other things, on the device model, operating system, security patch level, encryption and means of access. An FFS extraction is not the same as a bit-for-bit physical memory image, and it guarantees neither access to all content nor the recovery of all deleted data. The depth of the acquisition and any limitations are documented in the examination report.
A forensic extraction is different from an ordinary file export from the device, and different from a spyware examination with the MEFF M3-PRO.
Technical limits
These limits are stated before the instruction, not afterwards.
- Modern devices are fully encrypted; without the passcode, access is often impossible.
- The extraction depth depends on model and firmware and cannot be promised in advance.
- Messages deleted long ago may have been removed from the database entirely.
- Content stored only in the cloud is not part of a device extraction.
FREQUENTLY ASKED QUESTIONS
Smartphone forensics: frequently asked questions
Sometimes. Deleted records often remain in the database until the space is reused. Whether they survive depends on the app, the device and how much has happened since deletion.
Analysis takes place on the secured working copy in the permanent examination rooms at the registered office in Krefeld, Germany. Devices are handed over in person or sent by insured carrier; by prior arrangement, processing in Munich is also possible. Where the technical conditions allow it, the acquisition itself can also be carried out at the client’s premises or at the location of the item; unavoidable changes to a running system are documented with reasons.
Whether an expert report is used in proceedings, and what evidential value it carries, is decided by the competent court or investigating authority. Our examinations are documented so that third parties can review them: recorded handover, cryptographic hashes, described methods and a clear separation between technical finding and assessment. A binding assurance of later admissibility cannot be given.
Not guaranteed. Whether deleted messages, call logs or chats can be recovered depends on the device, the type of acquisition, the encryption and whether the relevant storage areas have already been overwritten. Encryption and storage management on current devices can considerably limit recovery. What is possible is the analysis of remaining database remnants, backups and synchronised copies. Recovery can never be promised – only examined case by case.
No. A technical examination can establish whether defined indicators – known spyware signatures, suspicious profiles, unusual permissions or suspect network connections – are present at the time of examination. A definitive exclusion is technically impossible, because methods and device generations differ in reach. The result is therefore always a statement about the indicators examined at that point in time, not a guarantee for the future.
Do not keep using the device, do not install supposed cleaning or anti-spyware apps, do not factory-reset, do not update the system and do not make test calls. All of this can overwrite traces or alert the attacker. The device should be disconnected from the home network but not switched off without consultation – depending on the model and lock state, a powered-off device is harder to acquire later. Note the time suspicion arose, the observed anomalies and any steps already taken.
Next step
Discuss your case
Describe the situation briefly. We will say what can realistically be established, and what cannot.