Cookies on the
LGC website
We use cookies to ensure that we give you the best experience on our website. If you continue without changing your settings, we’ll assume that you are happy to receive all cookies on the LGC website. However, if you would like to, you can change your cookie settings at anytime.
Question markFind out more

Forensic analysis of mobile devices

Mobile phones and PDAs (personal digital assistants) are a key element of modern criminal investigation. As well as being used to make and receive phone calls, these are multifunctional devices for text messaging, taking pictures and managing diaries, with a large storage capacity.
The distinction between mobile phones, smart phones, PDAs and even computers is becoming blurred. Our investigators are able to analyse a wide variety of devices form leading manufacturers such as Alcatel,  Apple,  Blackberry,  HTC,  LG,  Nokia,  Motorola,  NEC,  Palm,  Samsung,  Siemens,  Sharp,  Sony Ericsson, and Windows Pocket PC.
The digital evidence that can be found on mobile phone devices and PDAs include:
  • Phonebook - list of names and numbers stored
  • Call records - dialled, received and missed calls. The device may also store a recipient/sender log for messages
  • SMS - short message service: all text messages stored
  • MMS messages – these are messages that can be sent from and received by a mobile phone with media files such as photos and videos attached. They can also contain text messages
  • Email messages - newer models of mobile phones can send and receive email messages over the internet
  • Push Messages – these are specially formatted text messages that display an alert on your mobile phone. It gives the option to connect directly through a web link via the mobile phone's internet browser
  • Pictures - photos can be captured directly from a mobile phone's camera or downloaded from the internet. Pictures may also be transferred to a mobile phone from another digital device
  • Videos - videos captured by the phone's camera, downloaded from the internet or transferred from another device
  • Audio recordings - audio/voice can be recorded by an inbuilt microphone, downloaded from the internet or transferred from another device
  • Music – can be downloaded from the internet or transferred from another device
  • Documents – can be created using the device's applications, downloaded from the internet or transferred from another device
  • WAP - wireless application protocol, provides internet access and web browsing, storing recent history and bookmarks
  • Organiser details - calendar entries/notes/tasks are stored
  • Bluetooth details – keeps a record of wireless communication between devices
  • Deleted data - deleted information can sometimes be recovered from digital circuitry, such as SIM cards
For forensic analysis, three components are relevant:
  1. SIM (subscriber identity module) card memory,
  2. handset memory
  3. removable memory card.
Each is examined separately using a variety of forensic techniques.
Our experts will produce evidential reports containing all the data recovered from the device as required by the investigating team. Any media recovered will be provided in CDROM or DVD format suitable for court. We will help clients prepare witness statement and, if required, personally deliver this in court. Our investigators have retrieved and analysed stored data in several different languages and recovered information from damaged devices.
Our procedures follow the ACPO (Association of Chief Police Officers) guidelines and PACE (Police and Criminal Evidence Act) codes of practice to ensure the integrity and continuity of exhibits and the overall accuracy and quality of the evidence that we report and present. High standards have earned UKAS (United Kingdom Accreditation Service) accreditation for our laboratory.