Mobile Phone Experts Who Look Behind the Screenshot

Global Digital Forensics has operated since 1992, and its mobile work draws on Veronica Perez, a Senior Computer Forensic Specialist who has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago. Her work for attorneys, law enforcement agencies, corporations and insurers covers fraud, intellectual property theft, trade secret disputes, employee disputes, patent and copyright matters and breach of contract, and her examinations reach mobile communications, application activity and location records.

A message timestamp or a location point rarely answers the whole question. We examine the available phone and related cloud evidence to explain how each record was created, how it relates to the other activity on the device and what conclusion it can support, and we identify the handsets, linked computers, accounts, applications and period relevant to the dispute before choosing what to examine. Comparing those sources often surfaces evidence that is absent from a single phone and shows how much of a conversation each source actually preserves.

If the phone has not yet been collected, call (800) 868-8189 first; the collection method decides what an expert can later say about it.

The sources available to a mobile phone expert include device extractions, backups, application databases, media metadata and provider records supplied through the appropriate channels, and which of them survive depends on the device, the software version, the account access, the retention settings and the collection method that was used.

For a disputed conversation we examine the source account and device, the time conversions, the attachments and the surrounding messages, and we treat participant attribution as a question to be proved rather than assumed, because a contact name saved by a user does not by itself identify who controlled the other account.

Holding a screenshot the other side says is the whole conversation? Ask us what the records underneath it would have to show, and we will tell you what to request.

We check time zones, synchronization, shared accounts and gaps before we compare events, because a timeline built on a displayed time rather than the underlying record is the first thing a careful opposing expert takes apart. A location artifact describes a particular device or service record, and a conclusion about a person requires the source precision and the corroboration appropriate to that question.

A collection report should identify the device, the method and the material recovered. Exports, screenshots and extracted application records carry different levels of context, and we keep those differences visible when comparing sources so a partial display is never presented to the court as a complete history.

The digital forensics process guide explains how an examiner gets from a displayed time to a sourced timeline; read it before the opposing report arrives.

The engagement can include review of a competing opinion, a sourced timeline and technical exhibits built for trial. We assess retained deleted content and the relevant alternate sources where the records support it, and we document the actual recovery rather than assuming a complete message history exists somewhere.

A useful exhibit aligns a message with the related file, account or device activity while preserving the source of each entry. Location evidence gets its own explanation of origin and precision, and the report distinguishes a recorded device event from a conclusion about who held the device or what that person intended. Call (800) 868-8189 to discuss the opinion your case needs.

Phone and cloud examinations produce different material. A cloud account may retain messages, files or photos that were never downloaded to the handset, while the phone can hold local application records that never reached the account, so we consider both when planning an opinion about the full evidence available.

In Apple iCloud, synchronization is different from backup

Apple distinguishes synchronized iCloud content from device backup data. Depending on the settings, the relevant photos, files or other records may sit in iCloud Photos, iCloud Drive or another synchronized service, and we assess those sources separately and confirm the encryption and the account access available for collection. Apple explains what iCloud backs up ↗.

In Google accounts, look beyond the Android backup

We treat an Android backup, Gmail, Google Drive and Google Photos as separate evidence sources. Google notes that applications differ in the data they back up or restore, so we identify the services and the retained records needed to assess what the phone evidence supports. Google describes Android backup and restoration ↗.

Samsung accounts and connected services

A Galaxy device may use both a Samsung account and a Google account. We check the configured Samsung Cloud backup and the other connected services for the actual device, region and settings, including where files or photos are retained. Samsung describes Galaxy backup options ↗.

We plan preservation before anyone changes synchronization or restores a backup. Sync can propagate a deletion, a backup can be replaced and retention differs by source, so keeping the original state protects the records that are still available.

Before anyone signs in to an account or restores a backup, tell us which accounts are linked to the phone and we will set the preservation order.

When an application displays a conversation that a supported export cannot obtain, documented screenshots or a visual capture can preserve the visible record. We weigh that option against the available collection methods and the risk of changing data, and the capture requires the conversation to be accessible on the device.

For Signal and other encrypted applications we confirm the actual platform, the settings, the backup or transfer options and the recovery material. Signing in to the cloud account rarely reaches the message history of an encrypted app, so the method follows the authorized source that is actually available. Signal documents its current backup and transfer options ↗.

Preserve the conversation and its context

A documented capture should retain the visible conversation identity, the dates and times, the relevant surrounding messages and the attachments where available, and overlapping images help show sequence. We record the device and application used, who made the capture, when it was made and any gaps, keep the original image files and hold annotated or redacted copies separately. Where permitted and useful, a screen recording documents the navigation through the conversation.

Compare screenshots with supporting records

Screenshots show the displayed content and may omit identifiers, underlying times, delivery records, edits and deleted material. We compare them with the available device records, exports, backups and authorized sources to assess authenticity, context and participant attribution, and the report explains what each of those records adds.

Disappearing messages and applications that restrict capture call for particular care, because opening a message or changing a setting may affect the record. Leave the application, the backups and the retention settings exactly as they are, and talk to the examiner about preservation first.

That first conversation is free, so describe the application and what is visible and an examiner will say what to capture and what to leave untouched.

Apple Data Protection and Android file based encryption explain why access depends on the actual device, the operating system, the lock state and the credentials. We assess those conditions before choosing a method rather than assuming that an accessible backup on one device predicts access to another.

We establish the condition of the phone and the available collection options first. A supported extraction may contain only part of the application data, and cloud records, computer backups and other authorized devices may answer different questions, so the report identifies the source of each finding rather than presenting every item as if it came from the handset.

Consider a dispute over when a message was sent. The displayed time, the underlying application record and a cloud copy may each use a different time representation. We compare the records, account for time zones and document the gaps, because attributing an action to a person takes more than a device timestamp or an account name.

If the phone is locked or damaged, tell us the model, the operating system and the credentials available before collection is scheduled, and we will say which methods are realistic.

Veronica Perez, Senior Computer Forensic Specialist, has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago. She served with the Los Angeles School Police Department from 2001 to 2007 and the West Covina Police Department from 2007 to 2016, has taught mobile forensics for the California Department of Justice Advanced Training Center and Teel Technologies, and holds the EnCase Certified Examiner, Paraben Certified Mobile Phone Examiner and Cellebrite credentials listed on our About page. Robert Knudsen adds hundreds of computer and mobile device examinations supporting federal and state court matters. Meet the GDF team and request a current CV. Expert selection and availability are confirmed during scoping, and the examiner who does the work is the examiner who testifies.

Expert disclosure dates drive availability, so send us the schedule early and we will confirm who can be designated.