Device Information: The Identity Every Case Starts With

Every examination has to start with a plain question: which phone is this. The device profile answers it. Sherlock Forensics iPhone Analyzer surfaces the identity of the device into one overview: the model, the iOS version, the serial number, the IMEI where it is present, the storage capacity, the device name the owner set, the account signed into it and the backup dates the evidence retained. It is the first screen an examiner reads, because everything else in the case is an artifact belonging to this specific device.

These fields are small but they carry weight. The device name and account personalize a piece of evidence that would otherwise be a mass of records. The iOS version tells an examiner what the device was capable of and which artifacts to expect. The capacity and model set expectations for how much data should be present. Read together, the profile turns an anonymous extraction into a named, dated, identified device, which is the foundation the rest of the analysis is built on.

The device profile does three jobs that hold the rest of the examination together. First it establishes identity: the serial, the IMEI and the model can be matched against the identifiers recorded when the phone was seized or received, so an examiner can document that the evidence analyzed is the case device rather than assuming it. That single check heads off a challenge that can otherwise unravel an entire report.

Second it fixes provenance: a named device with a known account and known backup dates ties the evidence to a source and a moment, which is what a defensible chain depends on. Third and easy to overlook, it anchors the clock. The device timezone recorded in the profile is what lets every timestamp elsewhere in the examination read in the correct local time, so a message, a call and a location line up honestly rather than drifting hours out of sequence. Get the device profile right and the timeline is trustworthy; get it wrong and every downstream time is suspect.

The identifying profile does not require deep acquisition. The core device identity, the model, the iOS version, the serial, the capacity, the device name and the account, is carried in an encrypted logical backup, so Sherlock builds the profile from a backup you make over USB from a device you can unlock and Trust, from an existing iTunes or Finder backup or from a Cellebrite UFED or VeraKey full-filesystem extraction. The identity of the device is available whichever way the evidence arrived.

A full-filesystem extraction can add further system-level detail around the device, but the identifying profile itself comes through a backup in full. That means an examiner can confirm which device an evidence file belongs to from the least invasive acquisition, which is exactly the check you want to be able to make early and cheaply.

Because the device profile is what ties evidence to a specific phone, it belongs in the record: the court-ready HTML report carries case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with the device profile recorded as the identity of the evidence, the documentation practice set out in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so testimony rests on it rather than on recollection.

Sherlock reads the device profile from evidence you can lawfully acquire: a device you can unlock, an existing backup or a full-filesystem extraction produced by acquisition tooling. It does not unlock a locked device and does not bypass a passcode. The profile identifies the device and the account signed into it, not the person who was holding the phone; attribution to an individual is a separate question weighed against the rest of the record. Sherlock reports the identifiers the acquired evidence carries and records them precisely, which is what an examiner can match against a custody record and defend on the stand.

Download the free edition, open a backup or extraction and read the device profile yourself. Unlock the full examination and the court-ready report when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: The forensic image load workflow · Read a VeraKey extraction · The full parser list · Product page