Mobile Device Preservation: State, Isolation and Source Records

Global Digital Forensics checklist. Edition 2026-11-03, November 3, 2026. 24/7 hotline (800) 868-8189.

A phone changes through its own activity as well as through the network. This checklist records the handset’s state, arranges a handling plan the examiner directs and identifies the device, account, backup and vehicle sources before anything is reset, reissued or traded in.

Why the Next Message Can Overwrite the One That Matters

Most messaging applications keep their content in SQLite databases. Deleted records can survive in unused space or in the write ahead log for a time, but ordinary use, secure deletion settings and database maintenance overwrite them. Each new message, sync or app update is a chance to lose the one that matters. Isolating the phone from the network reduces remote changes, but local processes keep running, so the goal is prompt collection.

Location history is spread across several places. Google Timeline is now stored on each device, with an optional encrypted backup. Handset caches, applications, carrier records and vehicle modules each hold different records with different precision. Identify each device and source separately, because each one holds part of the location record.

The Order of Isolation, Custody and Account Holds

The examiner and the authorized owner choose the handling for the actual handset. Before anyone interacts with it, record its power, lock, connection and management state. Airplane mode can leave some radios on, shielding has limits and the battery needs attention, so record the method used, how it was verified and how the phone is being kept charged. Leave the lock, the reset options and the settings as they are. Passcodes travel through a separate secure process; this checklist records only who holds access.

Coordinate with the MDM, account and backup owners. Preserve the management record and pause any wipe, retire or reset command. Identify the backup types, dates, ownership and retention before changing any setting. Counsel handles carrier and third party requests. Identify any relevant vehicle before it is repaired, reset or sold.

Who Handles the Phone and Who Leaves It Locked

Counsel or the responsible owner decides the scope and the authority for collection, including how personal and work material are separated. The person who receives the phone records its state and custody and calls the examiner for a handling plan. MDM owners preserve enrollment, last contact and command history. Account and backup owners confirm their sources and licenses. The examiner records the tool and version, any change the collection caused and what was captured and any gaps.

The person who most wants to unlock the phone is usually the one who should leave it locked. A manager scrolling through messages creates new read receipts, new database writes and new access times, and an opposing expert will show the court every one of them. A colleague who takes screenshots of a thread has produced images with no database behind them. If someone has already done any of these things, stop, write down exactly what was done and when, and tell the examiner so the extraction can account for it.

The Mistakes That Turn a Phone Into a Gap

Resetting, reissuing or trading in the phone is the most common loss, and it usually happens through routine IT work. Pause it through the owners who run it and record anything already done. A locked phone, a missing passcode or an earlier reset is a fact for the examiner to assess and work with.

Scope mistakes are subtler. A personal phone holds far more than any matter needs, and proportionality under Rule 26(b)(1) means collections are scoped to date ranges, participants and applications under a written protocol agreed before the device is touched. A collection limited to messages when the matter turns on location, or to the handset when the account holds the longer history, leaves the question unanswered. Counsel and the examiner settle the questions the collection must answer before it begins.

How GDF Collects, Including Remotely, Under the Direction of Counsel

Global Digital Forensics has examined mobile devices for counsel, insurers and corporate security teams since 1992. Veronica Perez, a Senior Computer Forensic Specialist whose work focuses on mobile device evidence, has provided mobile forensics instruction for the California Department of Justice Advanced Training Center and Teel Technologies, and her training includes JTAG, chip off and in system programming. The method follows the device: a logical extraction where that is enough, a full file system extraction where deleted message recovery requires reaching the application databases and their write ahead logs, and hardware methods where a device is damaged or old. Every extraction is hashed, the tool and version are recorded, and the report documents what was captured and any gaps.

Where the custodian is cooperative, supported remote collection changes the logistics. The owner connects the phone to a computer and follows a link we provide, the collection runs under our supervision, usually from a few minutes to overnight depending on the device and setup, and the owner normally keeps using the phone afterward. GDF mobile evidence has been accepted in court, and the examiner who performs the collection signs the report and the affidavit. The initial consultation is free. If a phone is about to be reset, reissued or traded in, call (800) 868-8189 before it happens.

State, isolation and location source register

Record the device ID, model and operating system where known, the owner and custodian, whether it is personal or work, the relevant accounts and the authority for collection. Record when it was observed and in which time zone, its power and lock state, the isolation method and how it was verified, the charging arrangement, the operator and the escalation contact. Keep changes and transfers in time order.

For each Timeline, backup, application, carrier or vehicle source, record the device or account, its settings, the period, the original time fields, the acquisition method and the evidence reference. Keep original values and note any conversion.

The Checklist at a Glance

The same rows are in mobile_device_preservation_checklist_workbook.csv, with columns for the owner, the date, notes, status, the evidence ID and the next action.

Sources