For the defense · iPhone & Android · Independent
Cell Phone Forensics for Criminal Defense — iPhone & Android
Independent review of the State's cell phone extraction — what the Cellebrite / UFED summary report doesn't show you.
When the State images your client's phone, the report they hand over is a filtered view. We re-examine the underlying extraction, recover data where possible, and explain what the summary report left out. It's one focus of our broader digital forensics practice.
The State already has the phone. You need someone reading it for the defense.
Law enforcement seizes the device, extracts it with a tool like Cellebrite, and produces a report built to support the prosecution's theory. It's accurate as far as it goes — but it's their selection of their findings.
An independent examiner asks a different question of the same data: what does the full record actually show? The extraction with three damaging texts often holds the surrounding conversation, the timing, the deleted context, and the metadata that change what they mean.
We tell you plainly when the data doesn't help your case; our job is an accurate, defensible answer, not a favorable one.
See how we present findings in our illustrative sample report, or learn more about digital forensic expert-witness work.
The categories of data a modern phone holds
Depending on the device, OS version, and how the phone was handled, the following may be recoverable. Nothing here is guaranteed — we tell you what's realistic for your device before any work begins.
Messages & chats
SMS, iMessage, RCS, and group threads — including deleted messages that may still persist in the database.
- SMS / MMS / RCS
- iMessage threads
- Deleted-message remnants
Encrypted & third-party apps
Chat and call records from app databases that the State's summary often skips entirely.
- Signal
- Telegram, and others
Call & contact records
Call logs, voicemail, contacts, and the connections between numbers and identities.
- Incoming / outgoing / missed
- Voicemail audio
- Contact attribution
Photos, video & media
Camera roll, downloaded media, and embedded metadata showing when and where a file was created.
- EXIF date/time
- Embedded GPS (where present)
- Deleted-media remnants
Location & movement
On-device location history, Wi-Fi and cell associations, and app records that support — or contradict — a placement.
- Significant-locations data
- App & map history
- Device-usage timing
Web, accounts & usage
Browser history, search terms, account artifacts, and device-activity records that reconstruct what happened, and when.
- Browser & search history
- Account / login artifacts
- Device activity timeline
Reviewing the State's Cellebrite / UFED extraction — and what the summary leaves out
Cellebrite UFED and Physical Analyzer are capable, widely used law-enforcement tools — but the report generated from an extraction is a curated subset, and the choices behind it matter.
A typical State disclosure is a PDF export — not the full extraction. Working from the
underlying extraction (the .ufd / image and its databases, not just the
printout), we see what the summary filtered out: adjacent conversations, untagged records,
native-form timestamps, and artifacts the template never surfaces.
Common gaps we look for: selective date ranges, filtered contacts or apps, content stripped of its original timestamp or time-zone, deleted material the report didn't flag, and tool interpretations presented as raw fact.
If the State produces only the report and not the extraction, that itself may be something for your motion practice — and we can help you articulate why the full extraction matters.
What a standard police extraction can't recover — and why a "partial" isn't the end
Not every seizure produces a complete image. Time pressure, a locked device, an unsupported model, or a shallower-tier extraction can all leave significant data uncollected.
A logical extraction — the most common, least invasive tier — pulls only what the phone's software will hand over, frequently missing deleted content, app databases, and large parts of the file system. If the State's evidence rests on one, a deeper independent examination may reach material they never collected.
A "partial extraction" noted in a report is a signal, not a dead end — it tells you the collection was incomplete, raising a fair question about what a more complete examination might change.
We assess what tier the State's extraction reached, what it typically captures, and whether a fuller examination is feasible and worthwhile for your case.
Challenging fabricated, altered, or screenshot "text" evidence
A screenshot of a text is one of the easiest pieces of "evidence" to fake — and one of the hardest for a jury to question. When the case turns on a disputed message, the source matters more than the picture.
A genuine message recovered from the device's own database carries metadata: timestamps, thread structure, sender/recipient identifiers, and a place in the conversation. A screenshot, re-typed quote, or edited image carries none of that — and the differences are detectable.
We compare the disputed item against the device data, examine the metadata and file artifacts of a screenshot or image, and report whether it matches what the device contains — and where it doesn't, explain why in plain terms.
We describe what the evidence does and does not support; we don't characterize findings beyond what the data shows, and the weight of any exhibit is for the court.
Damaged, dead, water-damaged, and locked devices
A phone that won't power on isn't automatically a phone with nothing to say. Depending on the damage and the device, recovery may still be possible.
Physical damage, liquid exposure, and storage failures range from trivially recoverable to not recoverable at all — rarely obvious which from the outside. We assess the device's condition and give a candid read on feasibility before any recovery attempt.
Locked and passcode-protected devices are a separate, evolving challenge — what's possible depends heavily on the model, OS version, and security hardware, and it changes over time. We'll tell you honestly whether access is realistic rather than promise a result we can't assure. We do not guarantee access to any locked device.
iOS vs. Android extraction tiers — logical, file-system, and physical
You don't need to be technical to cross-examine the State's examiner — but knowing the three tiers helps, because the tier used caps how much data the extraction can contain.
- Tier 1 · Logical The shallow pull The phone hands over what its software exposes — recent messages, contacts, call logs, some media. Fast and common, but it misses deleted data, much of the file system, and many app databases.
- Tier 2 · File-system The deeper image A copy of the device's file system — app databases, caches, and system artifacts the logical tier skips, where deleted-message remnants, app chat history, and detailed location records often surface. Feasibility depends on the model and OS.
- Tier 3 · Physical The full bit-for-bit copy A complete image of the storage, including unallocated space. The most thorough tier — but on modern encrypted iPhones and many recent Android devices, a true physical extraction is frequently not attainable, so confirm what a report labeled "physical" actually obtained.
Court-ready work — chain of custody, sound methodology, and reporting counsel can use
Findings only help if they hold up. Our process is built to survive cross-examination and to be understood by the people who decide the case.
We document chain of custody from the moment evidence reaches us, work from verified copies rather than originals, and record what we did and in what order — so the work is repeatable and reviewable.
Our methodology is built on established, peer-reviewable digital-forensic practice and is intended to meet the standards courts apply to expert evidence (Daubert and Frye, by jurisdiction). Where a technique is novel or contested, we say so plainly.
Reports come in two registers: a plain-English summary a judge, jury, and client can follow, and a technical appendix an opposing expert can test. See the format in our illustrative sample report.
For appointed counsel & public defenders
We work routinely with public defenders and appointed counsel, and we know the work often has to clear a funding step first.
- Step 1 · Scope A clear, written scope We start with a short call to understand the device, the State's evidence, and your question — then put the scope and estimate in writing.
- Step 2 · Funding Declarations supporting funding requests For appointed and indigent-defense matters, we can provide a declaration describing the work and its relevance, suitable for an ex parte funding application.
- Step 3 · Triage Flat-fee triage to test the question first Where it makes sense, we begin with a fixed-fee triage — a focused first look at whether a full examination is worth the larger spend.
- Step 4 · Examination Full examination & reporting If triage justifies it, we proceed to the full examination and deliver a court-ready report — and, where needed, testimony.
Serving southern Oregon and Maui — and defense teams nationwide
We have offices in Talent, Oregon, serving the Rogue Valley — Medford and the surrounding Jackson and Josephine County courts — and in Kahului, Hawaii, serving Maui.
Because much forensic work is performed on properly preserved copies, we also work with defense teams across the country. Devices can be shipped under documented chain of custody, and on-site acquisition arranged when needed.
Frequently asked questions
Can deleted texts really be recovered?
Sometimes. When a message is deleted, the underlying data isn't always immediately erased — traces can remain in the device's databases or storage and may be recoverable. Whether they actually are depends on the device, the operating system, how much the phone has been used since, and how long ago the deletion happened.
We don't promise recovery of any specific message. What we can do is assess your device and give you a realistic read on what's likely to be recoverable before you commit to the work.
Do you only work for the defense?
Yes. We are retained by criminal defense teams, including public defenders and appointed counsel. Our methodology is the same regardless of who retains us.
Do I need the physical phone, or just the State's report?
It depends on the question. Some work can be done from the State's report or extraction alone — for example, reviewing what the summary included and excluded, or evaluating whether an offered exhibit is consistent with the produced data.
But to recover deleted data or examine the device more deeply than the State did, access to the physical device or the full extraction is usually necessary. Tell us what you have, and we'll tell you what's possible with it.
What does it cost, and how long does it take?
Both depend on the device, the tier of examination, and what you need answered — so we scope and estimate each engagement individually rather than quote a flat number sight unseen. Where it fits, we can start with a fixed-fee triage so you learn whether a full examination is worthwhile before committing to the larger cost.
Reach out for a free case consultation and a written scope estimate.
Free case consultation
Tell us about the device and the State's evidence, and we'll give you a candid read on what's possible and a written scope estimate.
Rather talk? Call (530) 435-5055.
This page is general information about forensic services, not legal advice, and does not create an attorney–client or expert engagement. Recoverability of deleted or damaged data depends on the device and circumstances and is never guaranteed. We do not guarantee access to locked devices or any particular outcome. Cellebrite and UFED are products of their respective owners; Evntrace is independent and not affiliated with those vendors.