iOS · Android · Corporate and Personal Devices · MDM Enrolled
Mobile device forensics
The phone is usually where the conversation happened. It is also the device most likely to change between the day it mattered and the day someone thinks to preserve it.
A phone rewrites part of its own record every night.
Messages sync to a server and roll off the handset. Applications trim their own databases to save space. An operating system update installs overnight and closes an acquisition method that was available the week before. None of that is deletion in the sense anyone intends, and all of it narrows what can still be recovered.
What acquisition is possible depends on the model, the operating system version, the encryption state, and the condition the device is in when it arrives. That determination is made per device rather than assumed, and the method selected is recorded alongside the result so the two are read together.
The phone preserved this week is the phone you will still have next year.
Capabilities
What the examination covers
Forensic acquisition
Logical, file system, and full acquisition of iOS and Android devices where the model, operating system version, and lawful access permit. The method is chosen to maximize recoverable data without altering the source.
Deleted data recovery
Recovery of deleted messages, call records, photos, documents, and application data where the underlying records survive. What could not be recovered is documented as clearly as what could.
Communication analysis
SMS, iMessage, WhatsApp, Signal, Teams, and other messaging platforms. Contact identification, timestamp and time zone reconstruction, thread continuity, and attachments tied back to the messages that carried them.
Application data
Data from installed applications including mail clients, cloud storage apps, productivity tools, and social platforms. Frequently the record of what left the device, and by which route.
Location and activity analysis
GPS history, cell and Wi-Fi connection records, and device usage patterns, used to establish where a device was and when it was in active use. Corroborated across sources before it is reported.
Reporting and output
Structured reports documenting acquisition method, tool and version, findings, and the limits of what the data supports. Output is delivered in a form your team can search and produce from.
Platforms
Devices supported
- Apple iPhone and iPad across current and legacy iOS versions
- Android devices from Samsung, Google Pixel, Motorola, LG, and other major manufacturers
- Corporate devices enrolled in MDM platforms including Microsoft Intune and Jamf, collected in coordination with your administrators
- Devices with full disk encryption, where acquisition method is matched to what the device and its state allow
- Legacy and end of life handsets, where aging evidence needs to be preserved before the hardware fails
Engage
When to call
- An employee is leaving and a company device needs to be preserved before it is wiped and reissued
- A separation matter involves suspected transfer of company data to a personal phone
- A litigation hold has issued and mobile evidence is within its scope
- An employment, HR, or internal investigation turns on what was said in messages rather than in email
- A regulatory inquiry requires documented evidence of activity on a device
- A custodian is holding a phone right now and needs to know what to do with it
Before you touch the phone
Do not open applications to check what is on it, do not connect it to a computer, and do not let it complete a pending update. Put it in airplane mode if you can do so without unlocking anything else, keep it charged, and call. Looking around on a phone changes the phone.
Pricing
Acquisition is flat. Analysis is separate.
Mobile device acquisition and processing is a flat $2,500 per single device. That covers forensic acquisition, hash verification, chain of custody documentation, processing, and output formatted for review. Analysis is billed separately at $150 per hour, and only when the matter calls for it.
You can take the processed output and search it yourself, or engage 4n6PI to perform the investigation. Where a matter needs one, a review platform is provided. Full rates and acquisition detail are on the forensic collection page, and a standing retainer puts rates and billing terms in place before a matter arrives, at no cost to establish.
Multi-device matters are quoted per engagement. The work is performed by certified examiners.
Preserve the device, then decide
Whether you have a phone in hand or need guidance before anyone collects it, the first conversation is free and takes about thirty minutes.