Services include acquiring and analysing mobile material, reviewing existing reports and preparing IT expert opinions. The scope may also include cloud data, smartwatches and SIM cards. I confirm whether I can undertake the work after a technical assessment and agreement on the commission.
Phone or copy—assessment and acquisition
What can actually be examined in the available material?
Material
A working device or existing copy; a description of provenance, access status and the scope of authorisation.
Work
Source identification, assessment of available methods and agreed data acquisition or preparation of a copy for analysis.
Result
An inventory of material received, the method used, and a report on categories obtained and limitations. Extended access is determined separately after assessing the model, system and security measures.
Enquire about the scope →Conversations and events—analysis of a selected scope
How to connect a message, file and time to a specific question
Material
An export, backup or data that can be acquired; the specified application, period and subject of analysis.
Work
Organising the timeline, identifying sources, linking available attachments and checking significant entries.
Result
A compilation of findings with references to the material. Identification of gaps, the significance of timestamps and issues that remain hypotheses.
Enquire about the scope →Existing report—checking the basis for the conclusion
Is the statement in the report supported by the source data?
Material
The tool-generated report, attachments and source files or a copy, if available; the question and passage requiring verification.
Work
Assessment of the report’s scope, artefact provenance, completeness of the supplied set and the ability to reproduce a selected finding.
Result
A description of what can be checked and the missing elements that hinder review. A PDF alone may be insufficient to verify the entire acquisition process.
Enquire about the scope →IT expert opinion—an answer with supporting reasons
Which conclusions can be supported by the examined material?
Material
An agreed collection of sources and specific questions; documentation of earlier actions, if it exists.
Work
Analysis of the issues covered by the assignment, checking significant data and separating observation from interpretation.
Result
A report or opinion in the agreed form: material, methods, findings, limitations and answers to questions. Its scope is not automatically determined by the software name or number of report pages.
Enquire about the scope →Arrangements before work begins
I prepare an individual quotation after assessing the material and purpose. Before work begins, we agree on the scope, price, availability, completion date and how the results will be delivered. A new device, additional files or changed questions may require these arrangements to be updated.
For the first contact, the material type, question, approximate period and any relevant deadline are sufficient. Do not send passwords or codes in a general message. We will agree separately on the channel for handing over the device and files.
Method and additional sources
The method depends on the exact device variant, operating system version, patches, encryption and lock state, as well as the available licence and equipment. A full file system extraction is not a physical image of the entire memory; an acquired image may still require decryption. Not every missing or deleted record can be recovered.
The service includes analysis of data from accounts and cloud services made available with proper authorisation, smartwatch records and available SIM data. Preparing a forensic SIM card serves to isolate a phone from the mobile network; the card does not provide a connection to the operator or duplicate a phone number. For each source, I establish the method, possible scope of acquisition and questions for analysis before accepting the assignment.
A practical description of mobile services and device preparation is also available on the Biegły Informatyk website.