What may be examined
Messages and attachments
An authorised examination may recover available conversations, attachments and associated records. A screenshot captures what was visible but may omit context, account information and original metadata.
Device and backup sources
An accessible device, an existing encrypted backup and a cloud export offer different coverage. The model, OS version, available credentials and app protections affect collection.
Photos and location records
Available metadata may help establish timing or a device’s recorded location. A recorded location is not proof that a particular person was there; source accuracy and context matter.
Before an examination
Keep the device in its current state and seek handling instructions promptly. Avoid updates, resets, deletion, repeated unlocking attempts or installing recovery apps. Tell the examiner whether it is powered on, unlocked, damaged or connected to a network. There is no universal power-off instruction for every phone.
What you can receive
Agree the accounts, date range, relevant applications and export format. Reporting can distinguish device records from backup or cloud records and identify missing periods, duplicate messages and time-zone conversions.
What the evidence may not establish
No blanket promise can be made to unlock a phone, recover every deleted message or bypass encryption. Remote changes, app retention and prior synchronisation can affect what exists.
Questions before you begin
No. Deletion, overwriting, encryption and the application’s storage design all matter. An existing backup or another authorised source may be more useful than the device itself.
Possession alone does not establish authority to examine it. The permitted access and purpose must be confirmed before collection. Do not share someone else’s credentials in the enquiry.