Mobile Device Forensics
Extracting and analysing communication records from smartphones and tablets.
Last reviewed
What does this service cover?
We extract and analyse data from phones and tablets, including messages, call logs, and application records. Deleted WhatsApp messages can be recovered where the data is still recoverable; results depend on the device, its settings and whether the data has been overwritten.
When do you need it?
Corroborating verbal contracts, message threads, or timeline agreements in dispute.
Investigating internal harassment, unauthorised disclosure, or fraudulent mobile interactions.
Recovering accidentally deleted business communications from mobile devices.
MOBILE FORENSIC WORKFLOW
Mobile Device Examination Process
Intake & Chain of Custody
Logging the device on a chain-of-custody record at intake, before any extraction begins.
Forensic Extraction
Extracting the data the device architecture and its security settings allow.
Messaging & Artefact Analysis
Decoding messages, call logs and application databases, including deleted records where the data is still recoverable.
Written Findings Report
A chronological communications timeline with the supporting extracts.
What do you receive?
A court-ready forensic report with filtered timelines of relevant communications and verified database exports. Whether evidence is admitted is decided by the court in each case. Expert witness testimony when instructed by counsel or the court.
- Physical and logical extraction of phones and tablets
- Deleted WhatsApp message recovery where still recoverable
- Chronological communication timelines and call records
- Reports prepared for use in legal proceedings, with a chain-of-custody record
FAQ
What do people ask about it?
Can deleted WhatsApp messages be recovered?
Yes, where the data is still recoverable. Results depend on the device, its settings and whether the data has been overwritten, so we assess the phone before quoting.
How is the device's data preserved during examination?
The device is logged on a chain-of-custody record at intake. We then follow a documented extraction procedure, using physical and logical extraction to capture the data the device allows.
Read the guides
NEXT
Call or WhatsApp us; we confirm scope and give an estimate before work begins.
Related Forensics Services
Start with a
confidential conversation.
View Park Towers, 20th Floor, Nairobi
+254 701 543 158
Monday–Friday 08:30–17:00 · Saturday 10:00–14:00
Remote consultations available on request.
Please don't send case details or evidence until we've agreed a secure way to receive them.