Mobile Forensics · Where the Evidence Lives · Lesson 5 of 5

Challenge: The Missed Inspection

Help an IT team check a company phone's photos, chats and locations.

The case brief

You work on the IT team at a building services company. A client says a technician, Jordan, never showed up for a safety inspection on Tuesday. Jordan says the visit happened and points to a photo of the equipment.

The phone involved is a company-owned Android phone issued to Jordan. Company policy, which Jordan signed, allows IT to examine work devices during an investigation like this, and the legal team has confirmed the examination is allowed where you are. Your scope is Tuesday's photos, work chats and location records on that phone. Nothing else.

You start with the photo. It exists in two places on the phone:

• In the camera roll, as the file the camera saved.
• In the company chat app, where Jordan sent it to a manager on Tuesday.

The manager also forwards you the copy from the chat, saying it should be just as good, since it's the same picture.

Reading the clock

The camera roll copy has its EXIF intact. It shows a camera make and model that match Jordan's phone, GPS coordinates near the client's building, and these two fields:

• DateTimeOriginal: 2026:09:15 07:50:12
• OffsetTimeOriginal: +02:00

The client's visitor system logs everything in UTC, so the photo time has to be converted the photo's time before you can compare the two. Remember that DateTimeOriginal is local clock time with no time zone of its own. The offset is what ties it to UTC.

The gap in the chat

The client also says Jordan messaged them to cancel. Jordan denies it. The company chat app keeps its messages in a SQLite database, chat.db, and Tuesday's rows have ids 118, 119 and 121.

A colleague made a working copy for you, but only copied chat.db. In the extraction, right next to it, was another file, chat.db-wal, which they skipped because it looked like a temporary file.

Two location records

Jordan's phone has two location records for Tuesday morning:

• 05:48 UTC, a point 300 meters from the client's building, accuracy radius 2,500 meters, from cell towers.
• 05:52 UTC, a point at the client's building, accuracy radius 15 meters, from Wi-Fi positioning.

Your manager wants a one-line summary for the report, and hopes it can say the cell record catches Jordan somewhere else. You check the distances against each radius before writing anything.