Cell Phone Forensics
Do you believe your cell phone has been hacked, or you need to find out what company data was compromised by an employee or any other scenario that requires your phone to be analysed? Then you have come to the right place. Our digital forensic services team can help you with forensic acquisitions, data recovery, compromise or vulnerability assessment, and investigations from most non-working (damaged, broken, faulty) and working Apple (iPhone and iPad) and Android cell phones.
The Four Data Extraction Levels We Typically Employ
LEVEL 1 - Logical Data Extraction
Level one is the extraction of visible user data, which may include some application data, where a file system data extraction is not possible. The extraction typically includes SMS, call logs, documents, photos, videos, and some application data.
LEVEL 2 - File System Data Extraction
Level two includes more file system data, where a full file system data extraction is not yet possible. This extraction does not include the recovery of unallocated space and hidden system files but, in some cases, enables the extraction of deleted files, including database records such as call log entries, contacts, messages (MMS/SMS), etc.
LEVEL 3 - Full File System Extraction
This level is also referred to as a physical extraction, which may involve rooting or jailbreaking the device to facilitate data extraction.
A clone is made of the system-protected areas, including unallocated space where possible. In some cases, it is possible to bypass user locks or passcodes and enable the acquisition of intact (unaltered) hidden or deleted data. This level can extract deleted and hidden files and system logs.
Unallocated space may contain deleted data such as SMS records, call logs, phonebook entries, media files such as photos and videos, deleted passwords, installed applications, geotags, location information, GPS fixes, emails, chats, etc.
LEVEL 4 - Hardware Data Extraction and Investigation
Level four is an advanced process of extracting data from a physically damaged (e.g. broken, faulty, dead, water damaged, etc.) cell phone. The process could include taking the device apart, removing the memory and other chips, and using techniques like JTAG and chip-off. It is typically a complex and time-consuming process, taking 2-4 weeks on average.
Other Data Extractions:
- SIM card extraction and cloning
- Password extractions
- Screenshots (Screen captures)
This method is typically used when we are unable to extract chat data, such as WhatsApp and Telegram messages, or for quick analysis and evidence backup.
(Or phone us at 012-665-2945 for a free data recovery consultation, evaluation and quotation)
