Mobile Forensics · Forensics Foundations · Lesson 1 of 5

What Mobile Forensics Is

Meet the field that turns a phone's data into evidence people can trust.

Evidence in your pocket

Digital forensics is the careful, documented process of finding, preserving and examining data from electronic devices so that the results can be trusted, often in a court. Mobile forensics is the branch that deals with phones, tablets and similar devices.

The key word is trusted. Anyone can scroll through a phone. A forensic examiner works in a way that someone else could check later, step by step, and reach the same result.

It's used in more places than crime shows suggest:

• Criminal cases. Police and prosecutors look for messages, photos, call logs or location history linked to an offense. Defense teams hire their own examiners to check that work.
• Civil cases. Disputes between people or companies, such as a contract fight or an employment claim, can turn on a text message or a photo's date.
• Corporate investigations. A company may examine a phone it owns and issued to an employee, for example when confidential files may have leaked.
• Incident response. When a phone may have been hacked, a security team examines it to learn what happened, how the attacker got in and what was taken.

The people doing this work include police digital forensic examiners, examiners at private labs, corporate security staff and incident responders. Some work as expert witnesses who explain their findings to a judge or jury. Most have training in both the technology and the rules for handling evidence.

One thing runs through all of these jobs. The examiner needs proper authority to look at the phone, such as a warrant, the owner's consent or the organization's ownership of the device. You'll learn more about that in the next module. In this track, every example assumes that authority is in place.

Four phases, rich and fragile

The US National Institute of Standards and Technology (NIST) publishes a widely used guide called SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics. It describes the work in four phases:

• Preservation. Securing the phone without changing its data. This covers finding it, documenting the scene, cutting it off from networks and packaging it safely.
• Acquisition. Copying or otherwise collecting the data from the phone, ideally in a lab with the right equipment.
• Examination and analysis. Examination is the technical step of exposing the data, including hidden or deleted items. Analysis asks what the results mean for the case.
• Reporting. Writing up every step taken and every conclusion reached, so others can follow and check the work.

Why does a phone get this much care? Because it's uniquely rich. Most people carry one all day. It holds messages, photos, contacts, browsing history, app data and records of where it has been. A single phone can say more about someone's life than their whole house, a point the US Supreme Court made in 2014.

It's also uniquely fragile. Unlike a paper letter, a phone keeps changing after it's found:

• New messages and app updates arrive and can overwrite older data.
• The owner, or anyone with the account password, may be able to erase it remotely.
• The battery runs down. You learned in Mobile Fundamentals that a restart drops a phone into BFU (Before First Unlock), where most data stays encrypted.
• Some apps delete messages on a timer.

That's why the first phase matters so much. Mistakes made in the first few minutes usually can't be undone later in the lab.