Mobile Forensics
Your Phone Holds the Evidence. We Extract It.
Court-ready mobile forensic analysis for iOS and Android. Logical extraction, timeline reconstruction and expert testimony. Results in 5-10 business days.
Mobile device forensics is the forensic extraction and analysis of data from smartphones and tablets. Sherlock Forensics performs logical extractions from accessible iOS and Android devices to recover messages, app data, photos, GPS history and deleted content. Standard extraction from $1,200 CAD with court-ready reports in 5-10 business days.
Smartphones hold more evidence than any other single device. Call records, text messages, location history, photos, app data and browsing activity are all recoverable through forensic extraction. Our examiners use validated forensic tools to extract and analyze this data, producing court-ready reports that withstand cross-examination. From deleted WhatsApp messages in family law cases to complete device timelines for criminal defense, we deliver the evidence your case requires.
Data Types
What We Extract
Logical extraction captures the full range of user-accessible data from iOS and Android devices. The following table outlines the data types we recover and any platform-specific considerations. All extracted data is preserved with original metadata intact for evidentiary use.
| Data Type | iOS | Android | Notes |
|---|---|---|---|
| Text messages (SMS/iMessage) | Yes | Yes | Including deleted if recoverable from backup |
| WhatsApp / Signal / Telegram | Yes | Yes | Full chat history with media |
| Call logs | Yes | Yes | With timestamps and duration |
| Contacts | Yes | Yes | Including recently deleted |
| Photos & videos (with EXIF/location) | Yes | Yes | Metadata preserved for court |
| Browser history & bookmarks | Yes | Yes | All browsers |
| Location history | Yes | Yes | GPS, WiFi, cell tower data |
| App data | Yes | Yes | Social media, dating apps, financial apps |
| Email accounts | Yes | Yes | Cached messages and attachments. For Outlook PST/OST archives, use Sherlock Forensics PST Viewer |
| Calendar & notes | Yes | Yes | Including shared calendars |
| Deleted data recovery | Partial | Partial | From unencrypted backups and databases |
Data availability depends on device model, operating system version and device state. During intake we assess the device and confirm what data types are recoverable for your specific case. For guidance on methodology standards, refer to NIST SP 800-101 Rev 1: Guidelines on Mobile Device Forensics. Compare Cellebrite vs Magnet AXIOM to understand the tools used in modern mobile forensics.
Process
How It Works
Every mobile forensic engagement follows a four-step process designed to preserve evidentiary integrity from intake through testimony. Each step is documented and verifiable.
- 01 Intake & Chain of Custody (Day 1)
- You ship the device to our secure lab. We photograph, document serial numbers and establish legal chain of custody. Every person who handles the device is logged. The evidence custody documentation travels with the evidence through the entire examination and is included in your final report. This documentation is critical for court admissibility.
- 02 Imaging & Extraction (Days 2-3)
- Forensic image created. Logical extraction using validated tools. Original device untouched after imaging. We generate cryptographic hash values (MD5 and SHA-256) of the forensic image to verify data integrity. All subsequent analysis is performed on the forensic copy, never on the original device. This ensures the original evidence remains unaltered and defensible.
- 03 Analysis & Reconstruction (Days 4-7)
- Timeline correlation, keyword search, deleted data recovery, artifact analysis. Cross-referenced with case objectives. Our examiners reconstruct communication patterns, establish device location at specific times and identify relevant artifacts across all extracted data types. Every finding is tied to its source artifact with timestamps and file paths documented for verification.
- 04 Report & Testimony (Days 8-10)
- Court-ready PDF report with evidence exhibits, methodology documentation and hash verification. Expert witness testimony available. Use our forensic report format for structured documentation. The report includes a methodology section explaining the tools and techniques used, an evidence summary with screenshots and artifacts, and a findings section organized by case objective. Reports are formatted for direct submission to BC courts.
Do Your Own Android Acquisition
Need to perform your own acquisition? Download Sherlock Forensics Android Acquirer for logical extraction with court-ready forensic reports. Free edition available. Forensic Edition from $399. Looking for an affordable Cellebrite alternative? See how Sherlock compares at $399 one-time versus $15,000+ annual. For a technical walkthrough of ADB commands and chain of custody procedures, read our ADB forensics guide.
Pricing
Mobile Forensics Service Tiers
All prices are in Canadian dollars. Each tier includes a full logical extraction and court-ready report. The difference between tiers is turnaround time. Select the service level that matches your litigation timeline.
| Service | What's Included | Turnaround | Price (CAD) |
|---|---|---|---|
| Standard Extraction | Full logical extraction + report | 10 business days | $1,200 |
| Priority Extraction | Full extraction + expedited analysis | 5 business days | $1,800 |
| Emergency / Active Litigation | Rush extraction + same-week report | 3 business days | $2,500 |
| Expert Witness Add-on | Court preparation + testimony | As scheduled | $2,500/day |
Multi-device discounts available. Contact us for cases involving three or more devices. Expert witness testimony can be added to any extraction tier.
Transparency
What We Are Transparent About
We perform logical extractions from accessible devices. This means:
- The device must be unlocked, or you must provide the passcode
- We do not bypass screen locks, encryption or device security
- We do not perform chip-off or JTAG hardware-level extraction
- For locked devices requiring physical extraction, we can refer you to a Cellebrite-certified lab
For the vast majority of legal, HR and insurance cases, logical extraction provides everything you need. If you are unsure whether your case qualifies, call us. We will tell you honestly in 5 minutes.
We believe transparency about capabilities is a sign of competence, not limitation. Firms that claim they can crack any device are either misleading clients or operating in legal grey areas. Our approach is straightforward: we tell you exactly what we can recover before you spend a dollar. If logical extraction will not produce the evidence you need, we say so and recommend the appropriate specialist. This saves you time, money and the risk of inadmissible evidence.
Use Cases
Who Uses This Service
Mobile forensic evidence is used across a wide range of legal and corporate matters. The following client types represent the majority of our caseload. Each requires specific data types and reporting formats tailored to their legal context.
- Family Law Attorneys
- Divorce, custody and asset disputes. Text messages, call logs and location data frequently serve as critical evidence in family court proceedings. We extract and organize communication timelines that demonstrate patterns of behavior relevant to custody determinations and financial disclosure. Our reports for civil litigation matters are formatted for direct submission to BC Supreme Court.
- Corporate HR Departments
- Policy violations and harassment investigations. When an employee's company-issued or BYOD device contains evidence relevant to a workplace investigation, forensic extraction ensures the data is collected in a legally defensible manner. We work with HR teams and employment counsel to define scope and preserve employee privacy boundaries.
- Insurance Investigators
- Fraud and claims verification. Mobile device data can confirm or contradict insurance claims by establishing location at the time of an incident, verifying communication with involved parties and revealing app activity inconsistent with claimed injuries or damages.
- Criminal Defense Attorneys
- Evidence verification and timeline reconstruction. Defense counsel requires independent forensic analysis to verify Crown evidence, identify exculpatory data and reconstruct timelines that may support the defense theory. We provide the same rigorous forensic methodology regardless of which side retains us.
- Civil Litigation
- IP theft, contract disputes and employment law. Mobile devices often contain evidence of confidential information transfer, non-compete violations and unauthorized data exfiltration. Our eDiscovery services integrate with mobile forensic extraction for complete evidence collection across all device types.
Logistics
Shipping & Intake
Ship to Our Lab
Ship your device to our secure forensic lab in Burnaby, BC. All devices are stored in a locked evidence room with restricted access and 24/7 monitoring from the moment they arrive until they are returned to you.
Shipping Your Device
Ship via tracked courier (FedEx, Purolator or Canada Post Xpresspost). Power off the device, place it in an anti-static bag and include a printout of your order confirmation. Your device passcode is collected securely during checkout. We provide a prepaid return label after analysis is complete.
Device Return
After analysis is complete, we provide a prepaid return shipping label. Devices are shipped back via tracked courier with signature confirmation required on delivery.
Shipping Instructions
- Power off the device before shipping
- Place in an anti-static bag
- Include a printout of your order confirmation
- Ship via tracked courier (FedEx, Purolator, Canada Post Xpresspost)
- We provide a prepaid return shipping label after analysis
Do not attempt to charge the device before shipping. Do not install or remove any apps. Do not factory reset the device. If the device is powered on, simply hold the power button and select "Power Off" before packaging.
Frequently Asked Questions
Mobile Forensics FAQs
- Can you recover deleted text messages from a phone?
- Yes. Deleted messages often persist in SQLite database free pages, app caches and cloud backups. Recovery depends on how recently they were deleted and whether the device has been reset. In our experience, messages deleted within the past 30-90 days have the highest recovery rate. Messages that have been overwritten by new data or that existed only on a device that has been factory reset are typically not recoverable through logical extraction.
- How much does mobile forensics cost in Canada?
- Standard logical extraction costs $1,200 CAD. Priority service is $1,800 and emergency rush is $2,500. Expert witness testimony is $2,500 per day. All tiers include a full forensic extraction and court-ready report. The only difference between tiers is turnaround time. Multi-device discounts are available for cases involving three or more devices.
- Do I need to unlock my phone before sending it for forensic analysis?
- Yes. We perform logical extractions which require an unlocked device or known passcode. We do not bypass screen locks or device encryption. Your device passcode is collected securely during checkout and stored encrypted. If the device uses biometric authentication only, you will need to add a numeric passcode before shipping.
- Is mobile forensic evidence admissible in court?
- Yes. Mobile forensic evidence is admissible when proper chain of custody is maintained and the extraction methodology is forensically sound. Our reports meet BC court evidentiary standards. We document every step of the process from intake to final report, generate hash values to prove data integrity and can provide expert witness testimony to explain methodology and findings under cross-examination.
- How long does a mobile forensic examination take?
- Standard examinations deliver in 10 business days. Priority service delivers in 5 business days. Emergency examinations for active litigation deliver in 3 business days. Turnaround begins when we receive the device and confirm it is accessible. Complex cases involving multiple communication apps or large volumes of media may require additional time, which we communicate before proceeding.
- Can you extract WhatsApp messages for court?
- Yes. We extract full WhatsApp chat history including text messages, photos, videos, voice notes and document attachments with timestamps preserved for evidentiary use. WhatsApp stores data in an encrypted SQLite database on the device. Our extraction process captures the decrypted database contents, preserving the original message timestamps, sender information and media attachments in a format suitable for court presentation.
- What happens to my phone during forensic analysis?
- We create a forensic image of the device data. The original device is not modified. After imaging, all analysis is performed on the forensic copy. Your device is returned with a prepaid shipping label. The forensic image is stored securely for the duration required by your case. We can provide a certificate of destruction when the data is no longer needed.
- Do you offer expert witness testimony for mobile evidence?
- Yes. Expert witness testimony is available at $2,500 per day. This includes court preparation, report review and live testimony explaining methodology and findings. Our examiner can be qualified as an expert witness in digital forensics and can explain technical concepts to judges and juries in plain language. See our expert witness services page for additional details.
Authority Resources
Standards & Related Services
Industry Standards
Related Services
Certifications
Our mobile forensic examiners hold industry-recognized credentials.
Get Started
Ready to get started? Choose your service tier and ship your device.
Select the turnaround time that matches your case timeline. All tiers include full logical extraction and a court-ready report. See also: private investigator forensic tools.
Not Sure If Your Case Qualifies?
Call us. We will assess your device and case requirements in a 5-minute phone call and tell you exactly what we can recover before you commit. No obligation.
Call 604.229.1994- Phone
- 604.229.1994
- Ship To
- Shipping address provided after checkout