Mobile device and messaging forensics
Collection and analysis of iPhone and Android devices and messaging apps such as iMessage and WhatsApp, with honest advice about what can and cannot be recovered and how to obtain the evidence lawfully.
Reviewed by the ITRS security team · Last updated
When phone evidence matters
Phones hold the conversations that rarely make it into email: texts with a supplier about side payments, WhatsApp messages with a competitor, photos of whiteboards, call logs that place someone at a meeting, location history that contradicts an account of events. They also hold traces of how a device was used in a cyber incident, such as an MFA approval at 2 a.m. or a malicious app.
Common matters include employment and departing-employee disputes, workplace harassment investigations, commercial litigation over agreements made by text, family law disputes over authenticity of messages, and incident response where a phone was the entry point.
Lawful access and consent
The first question is not technical. Before anyone examines a phone, there must be a lawful basis to do so, and that depends on who owns the device, who uses it, and what agreements or orders apply.
- Where consent is the basis, we document it in writing, including what will be examined and what will not. Where an order governs, we follow its protocol, which often involves an independent examiner and a review process for privileged or personal material.
| Situation | Typical basis for examination |
|---|---|
Company-owned phone issued to an employee | Employer ownership plus policy, scoped to the issues; counsel should confirm |
Personal phone used for work (BYOD) | Written, informed consent of the owner, limited to agreed data, or a court order |
Your own personal phone | Your consent; you may still have obligations regarding other people's information on it |
Opposing party's phone | Agreement between counsel or a court order specifying scope and protocol |
Acquisition types and their limits
NIST SP 800-101 Rev. 1 (Guidelines on Mobile Device Forensics) describes a range of acquisition methods, from manual review through logical and file-system extraction to more invasive techniques. What is achievable depends on the make, model, operating system version, whether the passcode is known, and encryption.
| Acquisition type | What it generally captures | Limits |
|---|---|---|
Manual (photographs or screen recording) | What is visible on screen | No deleted data or underlying metadata; last resort |
Logical | Data the operating system exposes through backup or sync interfaces: messages, contacts, call logs, photos | Often excludes some app data and most deleted content |
Full file system | App databases, system logs, location and usage artifacts | Depends on device and OS support; passcode usually required |
Cloud backup collection | iCloud or Google account backups and synced data, with credentials and consent | Only what was backed up, and only to the extent the account allows |
Messaging apps, deleted data and cloud backups
Modern messaging apps encrypt messages in transit, and many encrypt their local databases too. That does not make them unexaminable: with an unlocked device, a file-system extraction often recovers the app's message database including timestamps, participants, attachments and read status. iMessage and SMS live in the device's message database; WhatsApp keeps its own database and may have a separate encrypted backup in iCloud or Google Drive.
Deleted messages are where expectations most often exceed reality. On modern iPhones and Android devices, deleted records may survive for a time inside app databases, but storage is reclaimed quickly and full-disk encryption prevents traditional carving of free space. Sometimes deleted messages can be recovered from an older backup, or from the other party's device. We will tell you which applies before significant cost is incurred, and we never promise recovery.
Verification and reporting
Hash and log
Every extraction is hashed and recorded on a chain-of-custody log, consistent with ISO/IEC 27037.
Cross-check
Key messages are verified against more than one artifact or tool where possible, and timestamps are normalized with their time zone stated.
Scope the output
Reports and exports are limited to the agreed issues, date ranges and participants, so unrelated personal data is not swept into the record.
Explain authenticity
For disputed messages, the report addresses whether the record is consistent with genuine use, supporting the authentication and integrity questions under the Canada Evidence Act and provincial evidence statutes.
FAQ
In most cases, yes, for anything beyond a basic extraction. If it is not available, we will explain what remains possible, which may be limited to cloud data or other devices.
Screenshots are easy to challenge because they lack underlying metadata. A proper extraction preserves timestamps, sender identifiers and context.
Sometimes, from backups or the other participant's device. Recovery from the phone itself is increasingly unlikely as time passes. We assess before you spend.
Yes. Most extractions are completed without keeping the device for long; the forensic copy is what we analyze.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
- ServiceDigital forensics in Toronto: computers, phones, Microsoft 365 and Google WorkspaceIT Rapid Support provides digital and computer forensics services for businesses in Toronto, the GTA and Ontario, focused on Microsoft 365, Exchange Online and Google…
- ServiceDeparting employee and IP theft investigationsAn employee has resigned, possibly to a competitor, and you need to know whether they took client lists, pricing or source files.
- GuideWhat to do if a work or personal phone with company data is lostA missing phone exposes email, files and often the MFA codes that protect everything else. The steps differ depending on whether the company owns the phone.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.