Cell phone forensics: what it can and can't do

Phones hold a record of daily life: messages, calls, photos, locations, and app activity. When something goes wrong, people often hope a forensic examination will recover what was deleted or show what really happened. Sometimes it can. Sometimes the data is gone, encrypted, or was never on the phone in the first place. This guide explains what mobile-device forensics generally involves, what it can and can't do, the consent and ownership questions to settle before anyone touches a device, and how to keep a phone in the best condition for examination.

This article is general information, not legal advice.

What mobile-device forensics is

A forensic examiner uses specialized tools to make a copy of the data on a phone or tablet, called an extraction, and then analyzes that copy rather than the live device. Depending on the phone and the method, the examination may cover messages, call history, contacts, photos and their metadata, app data, and location records. A careful examiner documents each step, including who handled the device and when, so the process can be reviewed later.

What it can do

• Organize what is on the device into a readable form, such as a timeline of messages and calls around a date that matters.
• Recover some deleted items in some cases, depending on the device, its software, how the data was deleted, and how much the phone has been used since.
• Show signs of monitoring software on your own phone, such as unfamiliar apps or settings that could allow someone else to see your activity.
• Preserve a copy of the data as it existed on a given day, so it is not lost if the phone is later damaged, reset, or replaced.

What it can't do

• Guarantee recovery. Modern phones encrypt data and reuse storage quickly. Deleted messages may be unrecoverable, and there is no way to know for sure before the examination.
• Reach data that is not on the device. Messages stored only in the cloud, on the other person's phone, or with the carrier are not on yours.
• Get content from a carrier. Phone companies generally do not release message content to private individuals or investigators on request.
• Bypass authorization. Technical ability is not permission. An examination has to be lawful before it is useful.
• Decide what the data means in court. Whether any finding is admissible or persuasive is for the court and your attorney to assess.

Consent, ownership, and authorization

This is the first question, not the last. In general terms, examine only a device you own or are clearly authorized to examine. Someone else's personal phone, even a spouse's, a partner's, or an employee's, raises serious legal questions, and so does logging into another person's accounts without permission. Company-owned devices may be covered by workplace policies and by law, and those policies matter. Parents may have authority over a minor child's phone, but in a custody dispute that can become complicated.

If you are unsure, ask an attorney before the examination, not after. A reputable examiner will ask who owns the device and on what basis you are authorized to have it examined, and will decline the work if the answer is not clear.

Preserving a device

What happens to a phone before it reaches an examiner can decide what is recoverable. In general:

• Do not factory reset the phone, delete apps, or clear messages.
• Do not run do-it-yourself recovery apps; they can overwrite the data you want.
• Use the phone as little as possible, and avoid installing updates until you have spoken with the examiner.
• Ask the examiner before changing settings. In some situations they may advise isolating the phone from networks to prevent remote changes.
• Keep it in a safe place, and write down who has had it and what was done to it.

If you think someone is monitoring your phone and you are worried about your safety, use a different device to reach help. In an emergency, call 911.

What to have ready

• The device, its charger, and the passcode
• The make and model, and the accounts on it that belong to you
• The question you need answered and the date range that matters
• How you own or are authorized to examine the device
• Whether an attorney or a court matter is involved
• Who else has had access to the phone

Example (hypothetical)

A business owner believes an employee sent threatening messages from a company phone before resigning. The company's attorney confirms the device is company property covered by a written device policy. The phone was set aside in a drawer the day it was returned and has not been used. An examiner makes an extraction, finds some of the messages, cannot recover others, and documents both results for the attorney.

Room and vehicle sweeps are a different service from phone forensics; see bug sweeps and counter-surveillance. For concerns involving a partner or family member, see domestic investigations: what to know.

Talk it through

TB Defense is based in Chicago and led by a Chicago Police officer with 20 years of service, with investigative work that travels locally, nationally, and internationally. We start with the device, who owns it, and the question you need answered. Read about our private investigations, including cell-phone forensics, or Get protected and describe the situation.

Common questions

Can deleted text messages be recovered from a phone?

Sometimes. It depends on the device, its software, how the messages were deleted, and how much the phone has been used since. Modern encryption means recovery is never guaranteed, and there is no way to know for sure before an examination.

Can I have my spouse's or partner's phone examined?

Examining a phone you do not own or are not clearly authorized to examine raises serious legal questions. Speak with an attorney before anyone touches the device. A reputable examiner will ask about ownership and authorization and decline if it is not clear.

What should I do with a phone before it is examined?

Do not reset it, delete apps, clear messages, or run recovery apps. Use it as little as possible, ask the examiner before changing settings or installing updates, and keep a note of who has handled it.

Can a forensic exam show whether my phone is being monitored?

An examination of your own phone can look for signs of monitoring software, such as unfamiliar apps or settings. If you are worried about your safety, use a different device to reach help, and call 911 in an emergency.