Mobile phones now hold more evidence than almost any other device investigators encounter. Call logs, chats, location history, app data and cloud-linked information sit on a single handset, which makes mobile forensics, also known as mobile device forensics, one of the most important disciplines in modern digital investigation. At the same time, it is also one of the most misunderstood, with new questions coming up around encryption, damaged devices, locked phones and newly launched models almost every month.

This FAQ brings together the questions investigators and forensic teams ask most often, based on real queries raised during recent training and webinar sessions on mobile data extraction. The goal is simple: give clear, practical answers that help teams understand what is possible, what depends on the device, and where the real challenges lie.

What Is Mobile Forensics and Why Does It Matter?

Mobile forensics is the process of extracting, preserving and analysing data from smartphones and tablets so that it can be used as evidence in an investigation or legal proceeding. It covers everything from call records and messages to app data, media files and location history. As mobile devices have become the primary way people communicate, store information and manage their daily lives, mobile forensics has become central to criminal investigations, corporate inquiries and cybersecurity incidents alike.

How is mobile forensics different from digital forensics as a whole?

Digital forensics is the broader field that covers computers, servers, networks and any other electronic system that can hold digital evidence. Mobile forensics is a specialised branch within that field, focused specifically on smartphones and tablets. Because mobile devices run on different operating systems, storage structures and security models than computers, a digital forensic investigation involving a phone usually relies on its own set of extraction methods, tools and expertise, even though the underlying goal of preserving and analysing evidence stays the same.

What types of mobile forensics tools do investigators typically use?

Most investigations rely on a mix of extraction methods depending on the device and the level of access needed:

• Logical extraction – Pulls data through the device’s standard backup and file access channels.
• File system extraction – Goes deeper, capturing the underlying folder structure and cached data.
• Physical extraction – Where supported, retrieves a complete copy of the device’s storage, which can reveal deleted or hidden data that other methods miss.

Commercial mobile forensics tools typically combine several of these extraction levels with built-in decoding and reporting features, so investigators can move from raw data to usable evidence more efficiently.

Data Extraction and Access Questions

Can forensic tools crack a device password?

In many cases, yes. Whether the passcode is numeric, alphanumeric or a mix of letters, numbers and symbols, the general approach is the same: the tool has to attempt combinations until it finds the right one. Success depends heavily on the device model, its operating system version, and the security protections built into that specific handset.

What if a device uses biometrics or a pattern instead of a PIN?

Fingerprint and iris scans are secondary authentication layers, not the device’s primary security. Every phone still has an underlying PIN or pattern that biometrics ultimately fall back on. Forensic software targets that underlying credential rather than trying to bypass the biometric sensor itself, and success depends on whether the specific method is supported for that device.

What is the difference between standard brute forcing and distributed brute forcing?

Standard brute forcing relies on the processing power of a single workstation to try passcode combinations one after another. Distributed brute forcing spreads that same workload across multiple connected computers, so their combined processing power works on the problem at once. This can significantly cut down the time needed to crack longer or more complex passcodes.

Can an encrypted backup be brute-forced?

Encrypted backups, including those created through iTunes, can be brute-forced, but the process takes time. How long it takes depends largely on the hardware running the operation and the complexity of the password protecting the backup.

How is a dictionary attack different from a brute-force attack?

A brute-force attack tries every possible combination systematically until it finds a match. A dictionary attack takes a shortcut by testing commonly used passcodes, dates, patterns and words first, since people tend to reuse predictable combinations. Both methods can help investigators access a lawfully seized device, but their success still comes down to the phone model, iOS or Android version, and the strength of the passcode.

Device Condition and Recovery Challenges

What happens if a phone’s RAM is physically damaged?

If the RAM chip itself has suffered physical damage, recovery is usually not possible. RAM holds active data, and once the chip is compromised, that information is typically lost for good, regardless of which extraction method is used.

Can data be recovered from a phone that will not boot normally?

It depends on how the device fails. If the phone is completely dead with no power at all, extraction is unlikely. But if it still receives power and can enter an alternative mode, such as a manufacturer-specific download mode or a low-level boot mode, there is often still a path to extraction. If the device cannot enter any of these modes, recovery is generally not possible.

What can be recovered from a formatted phone?

A factory reset or format wipes user data, so extraction from a formatted device is usually limited to system files. Personal data such as messages, photos and app content is typically not recoverable once a full format has taken place.

Why do some phones fail to enter special extraction modes?

Manufacturers regularly patch the button combinations or triggers used to enter modes like EDL mode. A method that worked on one firmware version may stop working after a software update, sometimes requiring a hardware-level workaround such as a test point to gain the same access.

Can locked or carrier-restricted phones still be examined?

If the device supports physical extraction methods, restrictions such as carrier or EMI locks generally do not prevent the extraction itself, since the process works at a lower level than the lock screen. Support still varies by device and model.

App Data, Chats and Deleted Messages

Can messaging app data, like WhatsApp chats, be extracted?

Yes. Logical extraction on iOS and Android can typically pull WhatsApp and WhatsApp Business conversations, along with data from other apps that support backups through the operating system’s native backup process.

Is it possible to recover deleted messages?

Deleted message recovery, including from updated versions of WhatsApp, is possible in certain scenarios, but there is no guaranteed method that works every time. Success depends on how the app stores and clears data internally, and how much time has passed since deletion.

New Devices, File Formats and Interoperability

How long does it take for commercial mobile forensic tools to support a newly launched phone?

Full support for a brand-new device model typically takes around one to two months, depending on how complex the device’s security architecture is and how much demand there is for that specific model. In the meantime, generic device profiles, such as a general Android profile for logical extraction or a generic iPhone profile, can often provide partial access while dedicated support is developed.

What extraction file formats are typically supported?

Most mobile forensic platforms are built to work with a range of industry file formats, including standard Android and iOS extraction files, full file system data formats, and disk image formats. This kind of interoperability matters because investigations often involve moving data between different tools during analysis.

Can data extracted in one tool be used in another?

Many platforms allow extracted data to be exported to a standard archive format, which can then be imported and parsed in a different forensic tool. The data within these exported archives can also be accessed directly, which gives investigation teams more flexibility when they rely on more than one platform during a case.

Practical and Operational Questions

Does removing a license dongle affect an extraction already in progress?

No. If a license dongle is accidentally disconnected while an extraction is running, the process should continue unaffected. The dongle validates the software license rather than actively powering the extraction itself.

How many devices can be processed at the same time?

Most modern forensic solutions are designed to handle multiple simultaneous extractions, which helps investigation teams manage caseloads more efficiently instead of processing devices strictly one at a time.

Are there free tools available for digital forensics work?

Several open-source and free tools are commonly used alongside commercial platforms for specific tasks, such as parsing Android and iOS artifacts or calculating file hashes to verify data integrity. These tools are often used to supplement, rather than replace, a full forensic suite.

Why Mobile Forensics Expertise Matters

Mobile forensics rarely comes down to a single tool or technique. Device models, security patches, encryption standards and app behaviour all change constantly, and a method that worked last year may need an entirely different approach today. This is exactly why experienced forensic teams, and not just mobile forensics tools on their own, matter when it comes to recovering reliable digital evidence.

At Pelorus, our teams work across digital forensic investigations and specialist investigation services for law enforcement, government agencies and enterprises, helping them navigate exactly these kinds of extraction and recovery challenges. 

We work with the world’s leading mobile forensic solution providers such as Cellebrite , MSAB , Magnet Forensics , ADF Solutions , Oxygen Forensics , Compelson , Belkasoft , OpenText , GMDSoft , and many more.

To know more about our work and the agencies we support, visit our About page, or get in touch through our Contact page to discuss a specific investigation need.