Your smartphone knows more about you than almost anyone in your life. It tracks where you go, records who you communicate with, stores photos and videos, logs your searches, and retains data from dozens of apps. And even when you delete something, it is often still there.
Cell phone forensics is the discipline of extracting, preserving, and analyzing this data in a legally defensible way. In California civil and criminal matters, mobile device evidence has become one of the most powerful (and most contested) sources of information available. Here’s how it works.
What Can Be Recovered from a Cell Phone?
The short answer is: more than most people expect. A forensic extraction of a smartphone can potentially recover:
• Text messages and iMessages, including deleted messages that haven’t yet been overwritten by the device’s storage management.
• Call logs, showing incoming, outgoing, and missed calls; even those deleted from the visible call history.
• GPS and location data, including timestamped location history from the device’s built-in tracking, Google Maps, Apple Maps, and third-party apps.
• Photos and videos, including deleted media and the metadata embedded in image files (time, date, and GPS coordinates of where the photo was taken).
• App data, including messaging apps (WhatsApp, Snapchat, Signal, Telegram), social media, dating apps, financial apps, and more.
• Emails, including drafts and deleted messages stored locally on the device.
• Browser history, including private/incognito browsing in some cases.
• Device usage patterns, showing when the device was active, which apps were in use, and battery and network event logs.
The Forensic Extraction Process
Cell phone forensics is not simply copying files from a phone to a computer. A proper forensic extraction follows a documented protocol designed to preserve the original data, maintain chain of custody, and produce results that can withstand legal scrutiny.
Step 1: Document and Photograph
Before anything is done to the device, the forensics examiner documents its physical condition, serial number, and current state (including battery level and lock/unlock status). This creates the baseline record for chain of custody.
Step 2: Prevent Remote Wiping
Modern smartphones can be wiped remotely if connected to a network. The device is immediately placed in a Faraday bag or airplane mode is enabled to prevent any remote commands from reaching it while it’s being processed.
Step 3: Forensic Acquisition
Using certified forensic tools (industry standards include Cellebrite UFED and Magnet AXIOM), the examiner creates a verified bit-for-bit image of the device’s storage. The original device is never altered during this process. Any analysis is performed on the forensic copy, not the original.
A forensic image is cryptographically verified with a hash value; a digital fingerprint that proves the copy is identical to the original and that no data was added or changed during acquisition.
Step 4: Analysis and Recovery
The forensic image is analyzed using specialized software to identify, parse, and present data from the device, including data in unallocated space where deleted files may still reside. The examiner searches for relevant content and documents their findings.
Step 5: Reporting
Results are compiled into a forensic report that documents the methodology, tools used, chain of custody, and findings. This report is designed to be used in legal proceedings and can be accompanied by expert witness testimony from the examiner if required.
When Is Cell Phone Forensics Used in California Cases?
Mobile device evidence is relevant across a wide range of legal matters:
• Divorce and child custody disputes (location history, communications)
• Business litigation (communications about disputed transactions)
• Employment cases (harassment evidence, confidential data transfer)
• Personal injury claims (social media and GPS to verify or challenge claims)
• Insurance investigations (documenting activity inconsistent with claimed injuries)
• Criminal defense (establishing alibi, challenging prosecution evidence)
Can Deleted Evidence Really Be Recovered?
It depends on several factors. When a file is “deleted” on a smartphone, the phone marks that storage space as available for reuse but does not immediately overwrite it. Until new data is written to that space, the original content can potentially be recovered. If you want more information, check out my blog post I wrote earlier this year here.
The probability of recovery decreases the longer a device has been in use since the deletion, and it varies by device type, operating system version, and the specific app that generated the data. An experienced forensics examiner can assess what is likely recoverable before committing to a full extraction.
Hat Creek Solutions provides cell phone and digital forensics services throughout Northern California. Our examiners use certified forensic tools and follow protocols accepted by California courts.
Need to recover mobile device evidence for a legal matter? Contact Hat Creek Solutions for a confidential consultation.