Quick answer: Mobile forensics is the lawful extraction and examination of data from phones and tablets. The best known commercial tools are Cellebrite UFED, Magnet AXIOM and Oxygen Forensic Detective; on the free side, the ALEAPP and iLEAPP parsers and libimobiledevice. The essential concept to learn is extraction levels: logical (what the application hands over), file system (deeper) and physical (a raw memory copy, with the best chance at deleted data). On modern iPhones and current Android devices, hardware backed encryption usually makes physical extraction impossible, so setting realistic expectations is the most important part of the job.

A large share of forensic cases now runs through phones: WhatsApp messages in divorce proceedings, location records in employment disputes, gallery and call history in criminal investigations. Yet mobile is a far more closed field than disk examination: devices are encrypted, tools are expensive, and results differ per device. This article gives a realistic framework for learning mobile forensics.

Extraction levels: the most critical concept

The first question in a mobile examination should not be "which tool" but "what level of extraction can we achieve". There are three levels and the difference decides the outcome.

Level What it gets Deleted data Difficulty
Logical Contacts, calls, messages, app backup Very limited Easiest, possible on most devices
File system App databases, cache, logs Partially, from database slack Moderate, usually needs an unlocked device
Physical Raw memory copy including unallocated Best chance Hardest, usually impossible on modern devices

Why physical extraction became hard. Modern phones encrypt data with a hardware backed key: the Secure Enclave on iPhone, file based encryption on Android. Even if you copy raw memory, without the key the result is meaningless data. So the claim "we recover everything from a phone" is not realistic for most modern devices.

This is the honesty test of the profession. Telling the client or the prosecutor up front what can be extracted is better than delivering an empty result later.

Can deleted data really be recovered

This is the most frequently asked question and the answer is nuanced.

Most mobile apps store data in SQLite databases. When a record is deleted in SQLite it often does not vanish immediately, it may remain in the database freelist or in the WAL (write ahead log) file. A good parser can extract deleted messages from these areas.

There are two limits:

  • If the app ran VACUUM, the freelist may have been cleared.
  • If the device uses TRIM enabled flash, space freed at file system level may be physically zeroed.

So the answer is "sometimes yes, sometimes no", and you can only say which after examination. Be wary of an expert who guarantees results in advance.

Tools: commercial and free

Commercial

Cellebrite UFED. The most widespread tool in law enforcement. Broad device support, unlocking capabilities and strong parsing through Physical Analyzer. Licensing is expensive and some capabilities are provided only to authorized agencies.

Magnet AXIOM. Known for combining mobile, computer and cloud data in a single case. Its artifact driven approach and timeline view are strong.

Oxygen Forensic Detective. Particularly competitive in app support and cloud acquisition.

MSAB XRY. Another law enforcement focused solution, widespread in Europe.

Free and open source

This is the most valuable area while learning, because it teaches the logic of the profession without a commercial licence.

  • ALEAPP (Android Logs Events And Protobuf Parser) and iLEAPP (iOS Logs Events And Properties Parser). They take a backup or extraction, parse hundreds of artifacts and produce a readable report. This is the best free route into mobile forensics.
  • libimobiledevice. An open source library for communicating with iOS devices, used for backups and device information.
  • Limited editions of tools such as Andriller and MOBILedit.
  • SQLite browsers and freelist focused parsers for recovering deleted records.

The flow of a mobile examination

  1. Isolate the device. Put it in airplane mode and use a Faraday bag where possible. A remote wipe command destroys the evidence. Skipping this step is irreversible.
  2. Document the state. Is it powered on, locked, what is the battery level, what is on screen. Photograph it and record it.
  3. Collect lock and passcode information. A lawfully obtained password, PIN or biometric consent directly determines the extraction level.
  4. Extract. Start from the highest level achievable. The extraction itself must be recorded with a hash.
  5. Parse. Extract artifacts with a commercial tool or with ALEAPP and iLEAPP.
  6. Verify. Confirm a critical finding with a second tool. A report resting on a single tool's output is weak.
  7. Build a timeline. Combine messages, location, app usage and call records into one timeline. Normalize time zone differences.
  8. Report. Method, tool version, hashes and findings must each be stated.

Where each type of data lives

Artifact Where What it shows
Messaging App specific SQLite database Content, time, participants
Location System cache, photo EXIF, app logs Where the device was
App usage Usage statistics and system logs What was used and when
Notifications Notification database May hold remnants of a deleted message
Connected networks Wi-Fi configuration Places the device has been
Cloud backup iCloud, Google account May survive even after deletion on device
Health and step data Health database Moments the person was moving

The last row matters: step counter data can be far more decisive than expected, because it shows whether a person was in motion at a given hour.

Learning path

Month one. Learn SQLite. It is the language of mobile forensics. Being able to open a database, read its table structure and understand where a deleted record might survive is the foundational skill.

Month two. Back up your own phone and parse it with iLEAPP or ALEAPP. Working on your own data is lawful, and because you know the ground truth you also measure the tool.

Month three. Build an artifact map: which app stores what, where. Over time that map becomes your professional capital, because locations change as apps change versions.

After that. Move into cloud. In most modern cases the data lives in the account rather than on the device.

Frequently asked questions

Can deleted WhatsApp messages be recovered? Sometimes. Remnants may survive in the database freelist or in notification records, and a device backup improves the odds. Any answer offering a guarantee is not honest.

Can a locked iPhone be opened? It depends on the model, iOS version and passcode complexity. On current devices it is often impossible. Treat firm promises with caution.

Can mobile examinations be done with free tools? For learning and limited scope work, yes. Cases requiring unlocking or deep extraction need commercial tools.

Can I examine my own phone? Yes, working on your own device is the safest way to learn.

Is a cloud backup admissible evidence? If lawfully obtained, yes. Because data deleted on the device may persist in the backup, it is decisive in many cases.

What information is mandatory in the report? Device identity (IMEI, serial number), extraction level, tool and version used, the hash of the extraction, method and findings.

Sources

If you have a case requiring phone examination, the first rule is not to touch the device and to isolate it. For expert support or mobile forensics training for your team, contact DSET. From our Ankara Hacettepe Teknokent laboratory we run mobile extraction, analysis and expert reporting.