Mobile Forensics · Reporting & Ethics · Lesson 3 of 5

Scope, Privacy & Ethics

Stay inside your authority, protect private data and guard against bias.

Staying inside the lines

Phones hold more personal information than almost anything else a person owns. The US Supreme Court made this point in Riley v. California (2014), holding that police generally need a warrant to search the data on a phone seized during an arrest. Laws differ from country to country, but good examiners everywhere follow the same principle: the exam goes only as far as the authority allows.

That authority sets the scope, the limits of what may be examined. Common examples:

• A search warrant may cover only certain kinds of data or a date range, such as messages between two people over one month.
• Consent from the owner covers what they agreed to. In many places, including the US, consent can be limited or withdrawn.
• An organization's own devices can be examined under its written policies, for example a company-issued phone in an internal investigation. An employee's personal phone is a different matter.

Tools often copy far more than the scope covers, because a full extraction can be the safest technical choice. NIST's guide addresses this directly. With a warrant limited to, say, text messages, a full extraction may still be made, but care should be taken to report only the items the warrant covers. Copying everything is not permission to read everything.

NIST raises a second scope question. If a seized phone isn't isolated from networks, new messages may arrive afterward, and it may not be clear that the original authority covers them. That's one more reason to isolate a phone right after seizure.

What if an examiner comes across something that suggests a different crime, outside the scope? Rules vary, but the usual safe course is to stop, note what was seen, and ask for further authority, such as a new warrant, before going on. Many agencies have written procedures for exactly this situation.

Privacy, bias and testimony

Even inside the scope, a phone is full of other people's lives: friends' messages, family photos, health apps. Examiners treat this unrelated personal data with care. They look only at what the task needs, don't share or chat about it, and keep it out of the report.

Some data is privileged, meaning the law protects it from disclosure, such as confidential messages between a person and their lawyer. In the US, investigators often use a separate filter team (sometimes called a taint team) to set aside possibly privileged material before the case team sees it. Practices differ by country and by case.

Then there's the examiner's own mind. Confirmation bias is the tendency to notice and favor information that fits what you already believe. An examiner told "we know he did it" may search hard for messages that fit and skim past ones that point elsewhere. Researchers have documented this risk in digital forensics, as in other forensic fields. Common guards include:

• Receiving only the case information the task needs, not the whole theory.
• Writing down several explanations, including innocent ones, and testing each.
• Recording findings that weaken the case, not just ones that support it.
• Peer review, where a second examiner checks the work, ideally without being told the expected answer.

An examiner may also be called as an expert witness, someone allowed to give opinions in court because of specialized knowledge. Rules vary widely. In US federal courts, Federal Rule of Evidence 702 lets a qualified expert testify if the judge finds it more likely than not that the testimony rests on sufficient facts or data, comes from reliable methods, and applies them reliably to the case. A 2023 amendment stressed that each opinion must stay within what the methods can support. In practice, that means explaining plainly, admitting limits, and never stretching an opinion to help either side.