Forensic extraction services
Extractions are performed using industry-standard forensic tools and documented to meet chain-of-custody requirements for court use.
- Scope: the review of extracted data is limited to the date and time range and content specified by the applicable court order, search warrant, protective order, or written consent of the device owner
- Documented chain of custody: device intake, packaging, and handling recorded from receipt through return
- Hash verification: each extraction includes a preliminary report describing the extracted content, with SHA-256 hash values
- Single or multiple devices: smartphones, tablets, and other mobile devices
- Discovery and storage: export to portable drive for discovery production, and secure storage of extracted data when needed
Extractions we review
- Cellebrite (UFED, Physical Analyzer, Reader) reports
- Magnet AXIOM cases and reports
- GrayKey and other full-file-system extractions
- Messages, call logs, and contacts
- Application data and usage artifacts
- Device location artifacts and photo geotags
- Screen, unlock, and user-interaction activity
- Web history, search, and cloud-synced data
Artifacts need interpretation
Extraction tools parse raw data into tidy tables, but a timestamp in a report isn't always the time a user did something. It may reflect a sync, a notification, a background process, or a time zone conversion. Location artifacts may come from Wi-Fi, cell, or GPS sources with very different accuracy. Deleted or missing data has its own explanations.
We look past the report to what the underlying artifact represents, whether it supports the conclusion drawn from it, and what other data on the device corroborates or contradicts it.
Scope matters too. When reviewing another examiner's work, we check whether the extraction and the examination stayed within the authority of the warrant or consent, and whether chain of custody and handling are documented well enough to support the analysis.
Questions this analysis can answer
- Was the device being actively used at a specific time, or was activity automated?
- Who is likely to have been using the device, and how strong is the attribution?
- Do the messages, calls, and app activity line up with carrier records and other evidence?
- Did the examiner's search and reporting stay within the scope of the warrant?
- Is relevant evidence present in the extraction that the report didn't surface?
Background in this work
As a task force detective, Andrew McDermott used device extractions alongside CDRs, location data, and social media returns to build serial shooting, homicide, and gang cases, and served as the designated technical reviewer for digital data cases across partner jurisdictions. He later built training curricula on forensic device extractions for LeadsOnline.