Logical & Physical Extraction
Full-spectrum forensic extraction from iOS and Android devices. Logical extraction for accessible data; physical imaging for deleted content and file system artifacts.
Mobile Forensics
Mobile Device Forensics
Every tap, message and location - forensically recovered.
Mobile device forensics is the forensic extraction and analysis of data from smartphones and tablets, including iOS and Android devices. Sherlock Forensics performs logical and physical extractions to recover messages, app data, photos, GPS history and deleted content for litigation and investigations across Vancouver and British Columbia.
Modern smartphones contain more evidence than any other single device - call records, messages, location history, photos, app data and browsing activity. Our examiners extract and analyze this data using court-validated forensic tools, producing findings that hold up under legal scrutiny.
Capabilities
Mobile Forensic Services
Message & Chat Recovery
Recovery of SMS, iMessage, RCS, WhatsApp, Signal, Telegram and other messaging app data including deleted conversations, attachments and timestamps.
Geolocation Analysis
Extraction and mapping of GPS coordinates, Wi-Fi positioning data, cell tower connections and app-level location history to establish device movements over time.
Application Data Analysis
Forensic examination of installed applications - social media, dating apps, financial apps, cloud storage and productivity tools - including cached data and deleted records.
Cloud Account Acquisition
Authorized collection from iCloud, Google Account, Samsung Cloud and other cloud services linked to the target device. Captures backups, synced data and account activity logs.
Photo & Video Forensics
EXIF metadata extraction, creation date verification, deepfake detection analysis and recovery of deleted media from device storage and cloud backups.
Device Coverage
Supported Platforms & Devices
| Platform | Devices | Extraction Types |
|---|---|---|
| Apple iOS | iPhone 8 through iPhone 16 series, iPad Pro, iPad Air, iPad Mini | Logical, File System, Advanced Logical, Cloud |
| Android (Samsung) | Galaxy S20-S25 series, Galaxy A series, Galaxy Z Fold/Flip | Logical, Physical, File System, Cloud |
| Android (Google) | Pixel 4 through Pixel 9 series | Logical, File System, Cloud |
| Android (Other) | OnePlus, Xiaomi, Motorola, Huawei | Logical, Physical (model-dependent) |
| Tablets | iPad, Samsung Galaxy Tab, Android tablets | Same as corresponding platform |
Frequently Asked Questions
Mobile Forensics FAQs
- What data can be extracted from a smartphone?
- Modern smartphone forensics can recover call logs, text messages (SMS/iMessage/RCS), chat app data (WhatsApp, Signal, Telegram), photos, videos, GPS location history, browser history, email, contacts, calendar entries, app usage data, Wi-Fi connection logs and deleted content. Scope depends on the device, OS version and encryption state.
- Can deleted text messages be recovered from a phone?
- In many cases, yes. Deleted messages may persist in SQLite database free pages, application caches, iCloud or Google backups and file system artifacts. Recovery success depends on how recently messages were deleted and whether the device has been reset or overwritten.
- Does Sherlock Forensics work with locked or encrypted phones?
- We handle locked and encrypted devices regularly. Depending on the device, OS version and lock type, we employ consent-based unlocking, backup extraction, cloud account acquisition and advanced forensic methods. We advise on the legal requirements for compelled access under Canadian law.
- What is the difference between logical and physical extraction?
- A logical extraction copies accessible files and databases - similar to a backup. A physical extraction creates a bit-for-bit image of the device storage, capturing deleted data and file system artifacts not visible in a logical extraction. Physical extraction yields more evidence but is not available for all device models.
- Is mobile forensic evidence admissible in court?
- Yes. Mobile forensic evidence is admissible when proper chain of custody is maintained, the extraction methodology is forensically sound and findings can be verified. Our examiners document every step and produce reports meeting the evidentiary standards of BC courts, backed by NIST-tested forensic tools.
Authority Resources
Standards & References
Industry Standards
Related Services
Certifications
Our mobile forensic examiners hold industry-recognized credentials.
CISSP
Get Started
Ready to examine a mobile device?
Order a mobile forensic extraction online.
Order OnlineSubmit a Device for Forensic Analysis
Whether you need evidence from a single smartphone or fleet of corporate devices, our examiners can begin extraction within 24 hours of intake.
Call 604.229.1994- Phone
- 604.229.1994
- Burnaby Office
- Burnaby, BC, Canada
- Coquitlam Office
- Coquitlam, BC, Canada
- Device Intake
- Secure chain-of-custody intake at both locations