Phone evidence for attorneys. Convenient collection for clients.
Reviewed and approved by Joseph Caruso. .
GDF helps attorneys and clients preserve phone evidence through in-lab, remote and on-site collections. We select the method for the device, the information needed and the custodian’s schedule, then analyze the records for the questions in your matter.
A screenshot starts a question; it does not preserve the full conversation, account history or original attachments. Agree the model, operating system, lock state, credentials, authorized accounts, disputed period and needed records before choosing a supported collection.
Remote collection, a backup and direct extraction can preserve different records and make different changes to the phone. We agree on secure transfer, the help needed from the user and how any software installation or removal will be recorded. Deleted content and location history depend on what survives in the source, not the name of the collection method.
The report consolidates collection coverage, original records and interpretation limits. Ask for the proposed examiner’s relevant mobile experience, CV and available method support. The court determines qualification and admission for the particular matter.
Primary references: NIST forensic methods review (opens in a new tab) · Apple backup contents (opens in a new tab).
The right collection method depends on the phone, the information needed and how long the custodian can be without the device. GDF offers in-lab, remote and on-site collections. We discuss the available methods before scheduling so convenience does not come at the expense of evidence the matter needs.
The phone is shipped or couriered to a GDF lab, where an examiner performs the extraction directly from the device. The custodian is usually without the phone for 24 to 48 hours while it is with us; shipping time is additional, and the device's condition and extraction requirements can affect the schedule. We can provide a loaner phone when the custodian cannot be without one. If requested, GDF can retain the phone and collected data in evidence storage under an agreed retention arrangement.
For supported devices and collection needs, the custodian connects the phone to a compatible computer, downloads a collection agent and follows the prompts with GDF's guidance. The collection takes place at the custodian's location. Collected data is transferred to GDF servers, then downloaded for processing and analysis. This is often the most convenient option because the custodian does not need to ship the phone or travel. We confirm compatibility and explain any restrictions on phone use before starting. Remote collection does not provide every extraction method available in a lab.
GDF travels to an attorney's office or another mutually agreed location to collect the phone data. This can suit matters where devices must remain on the premises, several custodians need coordinated appointments, or counsel wants the handoff managed in person. We agree on access, workspace, timing and evidence handling before the visit.
A phone is only one part of the evidence. Apple iCloud, Google accounts, Samsung accounts and individual app services may hold backups, synced files, photographs, messages or account activity that is not present on the handset. Availability depends on the service, account settings, retention and encryption. A device extraction should not be assumed to include all related cloud data.
GDF works with counsel to identify relevant devices and accounts, establish authority to collect them, and set the date range and subject matter. We assess phone and cloud sources separately, documenting the collection method, timestamps, integrity checks and handling history. Where available, earlier backups and account records can help explain changes or supply evidence missing from the current phone.
Contact an examiner before resetting, updating, trading in or reassigning the device, removing accounts, or deleting apps. Continued use, synchronization and retention settings can change the evidence. We give handling instructions for the particular device and circumstances, coordinated with any urgent security needs, rather than applying one power or network instruction to every phone.
Where a chat cannot be extracted through a supported method, a documented screen capture may preserve what is visible. We record context such as the account, participants, sequence and capture method where possible. Screenshots do not replace underlying records or establish completeness; the report explains those limits and whether corroborating sources are available.
Veronica Perez is a Senior Computer Forensic Specialist whose experience includes mobile-device acquisition, location evidence and litigation support. She has provided mobile forensic instruction for the California Department of Justice Advanced Training Center and Teel Technologies.
The engagement
Text conversations, chat messages, photographs and phone activity can help establish what happened in your case. GDF works with counsel to identify the relevant evidence, preserve it and prepare it for review, discovery or testimony.
Your client keeps possession of their phone during remote collection. We send a collection link, guide them through connecting the phone to a computer, and handle the technical process. We explain when phone use must pause during collection.
Remote collection avoids device shipping and travel for an in-person handoff, helping reduce collection costs and time away from your client’s day. We plan around the phone, relevant apps, case priorities and deadline, with a clear scope for collection and analysis.
Scope
SMS, MMS, iMessage and supported data from apps such as WhatsApp, Signal, Instagram and Facebook Messenger.
Available photos, videos, contacts, call history, files and relevant backup records.
Conversation review, location evidence, recovery assessment, reports, affidavits and testimony.
Your client keeps possession of the phone throughout this remote workflow. Counsel can focus on the case while our forensic team guides the collection.
Collection can take anywhere from a few minutes to overnight, depending on the data and setup. Starting before bed can fit collection around your client’s work and family schedule. We provide a timing estimate and coordinate the schedule for analysis and reporting with counsel.
Tell us the evidence you need, your client’s phone and apps, and your deadline. We will help select an in-lab, remote or on-site collection and discuss scope, timing and collection costs.
We collect SMS, MMS, iMessage and supported chat-app data, including material from WhatsApp, Signal, Instagram and Facebook Messenger. Relevant attachments, participants and dates help place a conversation in context. The collection can also include available photos, videos, contacts, call history and files.
We match the method to your client’s device and apps. Tell us which conversations or records matter, and we can plan a targeted collection or a broader examination. Authorized account records, backups and linked devices can provide additional sources for the evidence you need.
If deleted messages or deeper app records are important, we can assess a full forensic extraction and relevant backups. A deeper extraction accesses additional areas of a supported device and may involve examination of the physical phone. Recovery depends on the device and the data that remains available.
We also look for relevant copies in older backups, linked devices and authorized account sources. Both remote collection and deeper extraction use documented forensic procedures; we select the approach that fits your matter.
Speak with us before resetting the phone, reinstalling apps or restoring a backup. We can help you preserve the best available evidence and explain the collection and recovery options.
Tell us the evidence you need, your client’s phone and apps, and your deadline. We will help select an in-lab, remote or on-site collection and discuss scope, timing and collection costs.
A phone backup can preserve earlier messages, files and other useful records. We examine its date, source and contents and compare them with the device and other available evidence. Collecting backups separately helps preserve the history needed to understand a conversation or event.
Device and app records, photographs and account information can provide location evidence. We assess timestamps and precision, compare sources and build a timeline that explains the supported activity. Our analysis connects the technical records to the questions counsel and clients need answered.
Past court acceptance provides context. The court decides admissibility in a new matter. The assigned examiner documents the actual collection, validation and source limitations for counsel and the court.
From collection through reporting, we record the source, method and handling of the evidence. Our experts prepare clear findings, supporting records and exhibits so counsel can present the evidence and explain how it was obtained.
Yes, GDF can provide expert testimony. Our qualified experts can prepare and sign reports and affidavits, be deposed and testify about their examinations and opinions. We explain the collection method and what the evidence establishes in language the audience can understand.
We can prepare conversation exhibits, searchable material and timelines suited to the engagement. When discovery production is required, we coordinate the format and scope with counsel. Meet our forensic experts and learn about expert witness and neutral examination services.
SMS, chat applications, local backups and linked devices do not store the same information, and one collection method will capture some categories well and miss others. Device model, operating system version, the application version and the access conditions all change what comes out.
We document the source and method for every collection and state which categories were available. An empty result is no proof that a conversation never happened. Retention settings, deletion, synchronization behavior or a collection limit can all produce the same blank. When the missing message is the point of the dispute, that distinction is the case.
Where appropriate, we compare the device against its backups, authorized account records, linked devices such as a tablet or laptop, or another participant's preserved copy. An independent copy can complete a broken thread or settle a disputed attachment, provided its own date and origin are documented as carefully as the phone's.
A single message can carry a sent time, a received time, a server event time and the device's local display time, and applications render them differently. We sort out which is which before placing anything in a sequence, because a chronology built on the wrong timestamp is confidently wrong by exactly the offset.
Attachments need the same care. A thumbnail, a forwarded image and the original media file differ in resolution and metadata, and in what they can establish. A photo saved on a phone was not necessarily taken by that phone. GDF checks the relevant records before drawing any conclusion about who created a file or where.
Location evidence is where careless work does the most damage. A coordinate can come from a photograph's metadata, an application event, a stored map search or a check-in, and each has a different precision and meaning. We explain what the record represents and how it compares with the rest of the evidence. We do not place a person at a street address from one unexplained data point, and we will say so if someone else has.
A phone holds years of personal life that has nothing to do with the case. We work with counsel to define the technical scope, the relevant periods and the review process, and where the source and the requirements allow, we use targeted collection or filtering to keep the rest out of the record.
Output can include conversation exhibits, searchable records and a timeline in which each entry links to its source. GDF's mobile evidence has been accepted in court, and our qualified experts provide reports and testimony when retained. Past acceptance guarantees nothing about the next matter. Careful collection and a clear explanation of the method are what carry the evidence each time.
Methodology
Identify the phone, accounts, apps, authority, dates and questions to be answered.
Use an appropriate remote or device-based method and record the source and handling.
Review and connect relevant messages, files, backups and location records.
Provide the agreed evidence, findings and expert support in a form counsel and decision-makers can use.
Evidence commonly examined
What you can expect
Frequently asked
They are useful as leads and as a record of what is being claimed. We then assess whether the original device or account records are needed to support a conclusion strong enough for the dispute.
No. We assess the supported methods for that device and look for other sources, such as backups or the other participant's phone. The device and the surviving records set the ceiling on what can be recovered.
Yes. The report and exhibits are written for the audience that has to use them, and the technical support behind every material finding stays attached.
Yes. We collect available mobile-device data, including messages and supported chat apps. We work with counsel to match the collection method to the client’s phone, apps and the evidence the case needs.
It depends on the collection method. In-lab work requires the phone to remain with GDF, usually for 24 to 48 hours excluding shipping, with timing confirmed for the engagement. A loaner can be arranged. Remote and on-site collections also require access to the phone, and we explain when use must pause.
Not always. GDF offers in-lab, remote and on-site collection. We recommend a method after discussing the device, supported apps and evidence needed. Lab collection involves shipping or couriering the phone; remote collection uses a compatible computer and collection agent; on-site collection takes place at an agreed location.
It can take a few minutes to overnight, depending on the data and setup. We help arrange a convenient collection schedule for your client and discuss analysis and reporting deadlines with counsel.
We assess deleted-message recovery using deeper forensic extraction and other available sources, including backups. Contact us to discuss the phone and the records you need.
GDF’s mobile-device evidence has been accepted in court. We use forensically sound procedures, verify and authenticate extracted data, and maintain chain of custody to support its use as evidence.
Yes. GDF has qualified experts who can prepare and sign reports and affidavits, be deposed and provide testimony about their findings.
Preserve the phone evidence with GDF before messages, backups or app records change. Tell us the device type, the relevant apps, the date range, the access status and your deadline. We can plan mobile device forensics collection, analysis, conversation exhibits and expert support around the needs of your matter. Your initial consultation is free.
Preserve the phone evidence with GDF
Related services and resources: computer forensics, email Microsoft 365 forensics, computer forensics expert witness.
Talk with an examiner
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Tell us what happened and what you need to find out. Speak with a GDF expert about how we can help.
24/7 hotline: 1-800-868-8189
When the evidence requires a technical opinion, explore the relevant expert witness service: