Conducted on-site or FedEx to our lab.
DOWNLOAD OUR FORENSICS BROCHURE
Professional Forensic Data Extraction
When you need-to-know for certain, and have hidden secrets professionally documented. Come to us.
Some data extraction need-to-knows…
- The HR department. Check ALL departing employee electronics for signs of intellectual property theft, photo espionage, kickback schemes, and other workplace crimes.
- Documenting evidence to exonerate, or better explain, a user’s predicament.
- Retrieve vital information thought to have been erased.
- Settle disputes about location and timing of events.
- Protection of minors.
Your IT Department Can’t Do This For You.
They don’t have the special forensic software and expertise required. They can only retrieve a small percentage of the secrets. Forensic mobile device data extractions yield huge quantities of data. It has been calculated that 64 gigabytes of storage is about 33,500 reams of paper if printed. In smartphones, 64 gigabytes of storage is common, and a ream is 500 sheets of paper.
What kind of hidden secrets do we find—and make sense of—in all these gigabytes?
Mobile Device Data Extraction Information
- Incoming, outgoing, missed call history.
- Phonebook or contact lists.
- SMS text, application based, and multimedia messaging content.
- Pictures, videos, and audio files and sometimes voicemail messages.
- Internet browsing history, content, cookies, search history, analytics information.
- To-do lists, notes, calendar entries, ringtones.
- Documents, spreadsheets, presentation files and other user-created data.
- Passwords, passcodes, swipe codes, user account credentials.
- Historical geolocation data.
- Cell phone tower related location data.
- Wi-Fi connection information.
- User dictionary content.
- Data from various installed apps.
- System files, usage logs, error messages.
- Deleted data from all of the above.
Keep in mind that this is not an exhaustive list.
Smartphones, PDA devices, cell phones, GPS devices and tablets are really mini computers. They reveal a rich history about the persons using them, and there are times when you need-to-know this history—and have it professionally documented. That’s when you come to us.
Data Extraction Steps
The mobile device data extraction is a two-part process. First, there is a logical data extraction (“what you see is what you get”), then a physical data extraction; a hex dump, a bit-for-bit copy of the device’s entire storage.
Physical data extraction recovers deleted information, decipher data, and information from password-protected applications such as Facebook, Skype, WhatsApp, and browser-saved passwords. The process can usually overcome a device’s password locks, and SIM PIN numbers.
When you see the data on the phone and you want to extract it for personal reasons, this extraction type will work for you. You’ll get call logs, text messages, calendars, pictures, audio, and video. If you use your phone strictly as a phone instead of a mini-computer, this will get a complete copy of your data. This level of extraction does not come with reports detailing the extraction and it is not prepared to be used in court. This is the most basic level of extraction and it does not pull information from every section of the device. If you need a copy of any chat data from apps, you would need to go with the next level of extraction.
When you need a full copy of the data on a device for investigation but not for court purposes, Extraction Plus is what you need. This extraction will give you a complete copy of the data, along with any deleted items, geolocation data, application data, web history data, and chat data. This extraction type would be good for someone documenting their activity for business purposes, for easy review of a device you inherited from a loved one, or maybe a review of a minor’s device. You’ll be able to review every speck of data extracted from the phone and parse through it easily.
Full Forensic Extraction
When you need to archive the data and the procedure used to get that data for a potential court case, only a Forensic Extraction will do. You’ll receive the raw extraction data, which can then be reviewed by opposing counsel’s forensic expert, along with a written extraction report detailing the unique serial number and pictures of the physical phone. You will receive everything in the other two types of extractions along with the highest level of documentation and the fullest set of data. This data cannot be recreated after the fact. If there’s any possibility of the case going to court, always choose a full forensic extraction.
*Some phones block extraction of certain data types.
**Geolocation data depends on app permissions and phone settings.
How to Schedule a Mobile Device Data Extraction
- Contact us, from a safe phone or computer. Tell us about your case.
- We will prepare a written estimate for your data extraction examination.
- Engage our services.
- We will schedule a mutually convenient time for our forensic technician to visit your location, or send us your mobile device via FedEx.
- Upon completion of the exam you will receive a verbal report, followed up with a written report. We also provide you with a USB stick containing the data, and an app which makes accessing the information easy.
Additional notes about our mobile device data extraction services…
- Data extraction is conducted using law enforcement level forensic technology.
- Inspection of multiple mobile devices during one session are discounted.
- Data extraction can be conducted in conjunction with a Mobile Device Spyware Detection inspection and/or our TSCM inspections.
We fully respect your privacy and confidentiality. Results are reported only to you.
Have a Question About Mobile Device Data Extraction?
If you have any questions about the the mobile device data extraction service provided by Murray Associates, simply fill out the form below, or call us from a safe area and phone.
If you think you are under active electronic surveillance, or believe you have discovered a bug or covert video camera, go to our Emergency TSCM page. The procedural checklist there will tell you exactly what you need to do next.