Cell Phone Forensics

Cell Phone Forensics Do you believe your cell phone has been hacked, or you need to find out what company data was compromised by an employee or any other scenario that requires your phone to be analysed? Then you have come to the right place. Our digital forensic services team can help you with forensic acquisitions, data recovery, compromise or vulnerability assessment, and investigations from most non-working (damaged, broken, faulty) and working Apple (iPhone and iPad) and Android cell phones.

The Four Data Extraction Levels We Typically Employ

LEVEL 1 - Logical Data Extraction

Level one is the extraction of visible user data, which may include some application data, where a file system data extraction is not possible. The extraction typically includes SMS, call logs, documents, photos, videos, and some application data.

LEVEL 2 - File System Data Extraction

Level two includes more file system data, where a full file system data extraction is not yet possible. This extraction does not include the recovery of unallocated space and hidden system files but, in some cases, enables the extraction of deleted files, including database records such as call log entries, contacts, messages (MMS/SMS), etc.

LEVEL 3 - Full File System Extraction

This level is also referred to as a physical extraction, which may involve rooting or jailbreaking the device to facilitate data extraction.

A clone is made of the system-protected areas, including unallocated space where possible. In some cases, it is possible to bypass user locks or passcodes and enable the acquisition of intact (unaltered) hidden or deleted data. This level can extract deleted and hidden files and system logs.

Unallocated space may contain deleted data such as SMS records, call logs, phonebook entries, media files such as photos and videos, deleted passwords, installed applications, geotags, location information, GPS fixes, emails, chats, etc.

LEVEL 4 - Hardware Intervention (Data Extraction) and Investigation

Level four is an advanced process of extracting data from a physically damaged (e.g. broken, faulty, dead, water damaged, etc.) cell phone or, in some cases, required to access a locked device. The process could include taking the device apart, bypassing the device's built-in systems, removing the memory and other chips, and using techniques like JTAG and chip-off. It is typically a complex and time-consuming process, taking 1-3 weeks on average.

Other Data Extractions:

SIM card extraction and cloning
Password extractions
Screenshots (Screen captures)
- This method is typically used when we are unable to extract chat data, such as WhatsApp and Telegram messages, or for quick analysis and evidence backup.