There’s always a certain element of uncertainty for solicitors when thinking about digital forensic providers and digital forensic evidence. How can Mobile Evidence really help your case? What evidence can you even get from a mobile phone? What should you tell your client in terms of his defence?

Technology is everywhere and mobile devices are ingrained into everyday life for billions of people around the world and especially the UK. It’s no surprise the depth and value of evidence that a mobile device can possess. However, we understand that for many solicitors and other legal practitioners, there is clear uncertainty around when to seek the services of a digital forensic expert and the how to go about it, who to choose, what to ask, what I require.

Below is a guide that will hopefully answer any questions you may have and help you on your way to applying digital forensic evidence to your case.

When to use a digital forensic expert for mobile evidence?

It’s understandable that solicitors do not always know when a digital forensic expert can be beneficial and when digital evidence is required. Mobile evidence can be integral to almost any case, whenever a mobile phone has been directly, or indirectly, used as part of an incident. In our experience, mobile forensics is particularly effective in cases of:

• Theft & Fraud
• Sexually Related Offences
• Assault
• Murder
• Anti-Social Behaviour or Abuse
• Drug Related Offences
• Indecent Images (IIOC)

No matter what the case is, you should always consult with a trusted provider about your individual, or sometimes, unique cases and requirements. You could be surprised by what evidence may come to light and how you could apply it.

How does communications data provide evidence for my case?

Clearly, for straight forward cases it is obvious that mobile forensics can be used to locate any evidence that may disprove or argue allegations that have been made. However, for other cases, mobile forensics can locate communications data which can be used as evidence just as effectively. Communications data encompasses the content and the details of a message, this is often highly indicative and insightful into your defendant’s activities, which could affect the overall indictment.

1. For example, in a murder case, GPS data, call logs, text messages and so on can be used to disprove the whereabouts of the defendant at a certain time, which in turn can influence the outcome of the indictment. This type of examination would be known as “Cell-Site Analysis”. Text message recovery and where it was sent from would also be applicable.
2. A further example is in a recent fraud case. Text messages were identified and used, to prove that our client’s defendant acknowledged messages for their tenant and offered various refunds and compensation. The tenant displaced this message, subsequently leading to false allegations being made against the defendant.
3. A final example was in a drugs case. A number of text messages constructing a meeting were allegedly sent by the client. We were able to review all deleted material from the phone which matched the accused mobile and determine that no such messages were sent from the SIM or device.

In a court of law, evidence is evidence, no matter how small or large it may be. By investing in mobile forensics, there is a strong chance that their communications data may be able to support your case and stand a better chance of obtaining your desired plea.

Mobile Forensic analysis methods

There are numerous methods that can be used to acquire communication data from mobile devices. By having a basic knowledge around the mobile forensic process, you will be able to identify what data could be used in the case.  Here’s how IntaForensics’ experts break it down. We are able to analyse:

• Handsets (mobile phones & smart phones)
• SIM cards
• Memory cards

We utilise a variety of both manual and automatic extraction depending on the type of device.

• Manual: Extraction of data from the mobile device that is not supported by forensic software or tools. This is done through manual identification, recovery and digital recording.
• Automatic: Extraction of data from a mobile device that is supported by forensic software and tools. The tools will automatically identify and extract the data without any manual review.

However, when a device is damaged, it may mean that straight forward extraction methods are useless, and incapable of retrieving any data. Should this be the case, we can undertake a chip-off, Chip-on (CODED) or JTAG examination to ensure we still retrieve the data that you require as per your instruction.

• Chip Off: The process of removing memory chips from the device and using forensic tools to extract the data directly from the chip. As the chip is removed from the device, this would render the device unusable, and is often used as a last resort means of data acquisition.
• JTAG: The process of utilising a processor to engage in the transferring of data stored on memory chips onto access ports, which can then be connected to forensic tools, otherwise only obtainable via the Chip-Off method.

Regardless of the condition of the mobile device, some forensics providers will still be able to extract data from it. By choosing a forensic provider with experts familiar with these highly specialised methods and tools, as well as Chip Off and JTAG facilities and knowledge, this allows us to give assurance that if there is any data to be found – it will be.

Step by step guide

1. Cease use/turn off the device – the more the device is used, the higher risk of overwriting valuable deleted data.
2. Call IntaForensics immediately. Please make sure you have the following information readily available:
   1. Make/Model of the device
   2. What data you require/remit of the investigation
   3. Is the data deleted
   4. Where is the phone now?
   5. Your clients name (If LAA Authority is required)
3. We provide free consultation on an exhibit-by-exhibit basis and discuss our proposed POA.
4. We will endeavour to aid, in the means that suits you, whilst offering competitive prices and completion timescales.
5. Once we have access to your client’s device, and all logistics are in place, we will commence our digital forensic investigation.
6. Upon completion, we will provide a full written, MG11 s9 Witness Statement and technical report which we will provide electronically as a matter of urgency, and a hard copy for use in court.
7. Optional use of our Bond Solon Certified Expert Witness – with our vast level of expertise, IntaForensics can ensure full support is provided in court, both written and verbally, to provide not only evidence of opinion, but evidence of fact.