Mobile Forensics Fundamentals

Mobile forensics is the discipline of recovering digital evidence from smartphones, tablets, and wearables in a forensically sound manner. Unlike disk forensics, mobile devices are always-on, constantly syncing, and tightly encrypted.

• Evidence lives in flash storage (NAND), RAM, SIM, and cloud backups.
• Devices are locked, encrypted, and remotely wipeable by default.
• Goal: extract data without altering it, then prove integrity in court.

Practitioners must balance technical extraction with strict legal authorization (warrant, consent, or corporate policy).

Capture the most volatile data first, because it disappears fastest. Mobile devices add unique volatile sources.

• RAM / running processes — lost on power-off.
• Network state, cellular connections — change constantly.
• Unsynced app data — may be overwritten.
• Persistent flash storage — least volatile.

A live device may auto-delete messages, rotate logs, or receive a remote wipe. Acting quickly on volatile sources preserves otherwise-lost evidence.

The first physical action is radio isolation. A device connected to cellular or Wi-Fi can be remotely locked or wiped before you image it.

• Use a Faraday bag or shielded enclosure to block all RF.
• If isolation is impossible, enable Airplane Mode (documenting every tap).
• Never power off a phone you have not assessed — boot may trigger encryption-at-rest you cannot bypass later.

Keep the device charged inside the bag; a dead battery can force a cold-boot state that loses RAM evidence.

Evidence is only useful if its handling is documented and unbroken. Chain of custody records who touched the device, when, and why.

• Record seizure time, location, device state (on/off, locked/unlocked).
• Log every transfer with signatures and timestamps.
• Photograph the screen, IMEI, and any visible damage.

Record identifiers before extraction. Example fields to capture during intake:

There is a spectrum of extraction depth, each with tradeoffs in completeness vs. intrusiveness.

• Manual — analyst scrolls the live UI, photographs screens. Fast, no tooling, but alters state.
• Logical — pulls files/databases via device APIs (backup, ADB, AFC). Misses deleted data.
• File system — full directory tree including app sandboxes and SQLite WAL files.
• Physical — bit-for-bit image of NAND, including unallocated/deleted space. Most complete, hardest to obtain on modern encrypted devices.

Choose the least intrusive method that satisfies the investigation.

To prove an image was not modified, compute a cryptographic hash at acquisition and re-verify before analysis.

• Use SHA-256 (MD5 is acceptable only for legacy cross-checks).
• Hash must match across every copy and at every handoff.
• Always analyze a working copy, never the original.

Generate and verify a hash of an extracted image:

Modern phones encrypt storage by default, making physical images useless without keys.

• Android File-Based Encryption (FBE) derives keys from the user credential + hardware-backed keystore.
• iOS Data Protection ties file keys to the passcode and Secure Enclave.
• A device in BFU (Before First Unlock) state has most keys evicted; AFU (After First Unlock) keeps many keys in memory.

Whenever lawful and possible, acquire while the device is in the AFU state — far more data is decryptable.

Understanding lock states determines what you can recover.

• BFU (Before First Unlock): device booted but never unlocked since power-on. Almost everything encrypted; only minimal metadata accessible.
• AFU (After First Unlock): user unlocked at least once. File keys are resident in RAM, so logical and file-system extractions yield rich data even if currently locked.

Practical rule: keep a seized device powered and do not reboot it. A reboot drops it back to BFU and may lose access to the passcode-protected keys.

The handset is not the only data source. Two adjacent reservoirs are often decisive.

• SIM card: ICCID, IMSI, stored contacts, and sometimes SMS. Read with a dedicated SIM reader to avoid touching the phone.
• Cloud backups: iCloud, Google, and app-specific backups (WhatsApp, Signal). Often contain data deleted from the device.

Cloud acquisition requires separate legal authority (warrant/subpoena) and proper credentials — never access an account you are not authorized to.

Practitioners combine commercial suites with open-source tools for cross-validation.

• Commercial: Cellebrite UFED, Magnet AXIOM, MSAB XRY — broad device support, automated parsing.
• Open source: Android Debug Bridge (ADB), libimobiledevice, ALEAPP/iLEAPP, autopsy.

A logical pull on a debug-enabled Android device might start with ADB:

Every action must be reproducible by a third party. Contemporaneous notes turn raw extractions into admissible evidence.

• Record tool name, version, and exact commands used.
• Note timestamps in UTC and any deviations from procedure.
• Distinguish facts (what the data shows) from interpretation.

If you cannot explain how a piece of data arrived in your report, it should not be in the report.

A seized Android phone arrives powered on and unlocked once earlier in the day, now showing a lock screen. Why should you avoid rebooting it?

You now have the core mental model for sound mobile forensics.

• Isolate the device (Faraday bag) to prevent remote wipe.
• Respect order of volatility and avoid rebooting AFU devices.
• Maintain an unbroken chain of custody and hash every image with SHA-256.
• Pick the least intrusive acquisition that meets the case need.
• Encryption (FBE / Data Protection) and BFU vs AFU state govern what is recoverable.
• Document tools, versions, commands, and UTC timestamps for reproducibility.

Next: hands-on Android acquisition and analysis.