Mobile Forensics
Mobile phone forensics for Canadian litigation and investigations.
Cellebrite acquisitions for routine cases, plus chip-off, JTAG, and ISP for damaged, locked, or unsupported devices. iOS and Android, with full file system parsing and app-artifact decoding.
When this service is needed
Typical scenarios where counsel and corporate clients retain us.
- Family law matters involving electronic communications
- Criminal defence and Crown matters
- Employment disputes and harassment cases
- Expert witness work and corporate misconduct
- Breach response involving mobile attack surface
- Damaged or locked devices other firms cannot extract
Differentiator
Three advanced extraction techniques for devices that conventional tools cannot read.
Most BC and Canadian forensic boutiques rely solely on Cellebrite or similar tools and stop where the tool stops. We go further. All three techniques below are run in-house at our Langley main office.
Chip-off forensics
Physically desoldering the eMMC, eMCP, or NAND memory chip from the phone's logic board to read raw flash with a specialized programmer. Destructive. The last resort for catastrophic-damage cases.
JTAG (Joint Test Action Group) forensics
Acquiring a forensic image through the device's debug port (test access points on the PCB) without removing the chip. Non-destructive. Used for devices that boot but won't unlock, or where supply-chain or country-locked variants block standard tools.
ISP (In-System Programming) forensics
Accessing the eMMC test points directly on the board. Often a faster, less invasive alternative to chip-off. Non-destructive. Used for damaged or locked devices when JTAG ports are unavailable.
How we approach it
A defensible, repeatable process.
Faraday isolation
The device enters a Faraday bag at intake to block cellular, Wi-Fi, and Bluetooth signals. This prevents remote wipe and post-acquisition contamination.
Acquisition
We attempt the highest-fidelity extraction the device supports. For modern iOS devices, that often means a Before-First-Unlock (BFU) or After-First-Unlock (AFU) acquisition, with checkm8 used where the chipset allows. For Android, we move from logical to file system to physical extraction depending on the model, OEM, and patch level.
Advanced extraction (when conventional tools fail)
Where Cellebrite and Magnet acquisitions are not possible, we move to chip-off, JTAG, or ISP extraction. These are explained in detail below.
Parsing and artifact decoding
The acquired image is parsed for messaging history (iMessage, SMS, WhatsApp, Signal, Telegram, Snapchat, Discord, Slack, Teams), location history, photos and metadata, browser history, app installs and usage, financial-app activity, password manager entries, and deleted-but-recoverable artifacts in the SQLite WAL files and unallocated space.
Reporting
Findings are documented with exhibit indexing, source-artifact references, and clear methodology disclosures, ready for affidavit or expert-report use.
Tools we apply
Named, current, and listed in every report.
- Cellebrite UFED Touch
- Cellebrite Premium
- Cellebrite Inseyets
- Magnet AXIOM
- Oxygen Forensic Detective
- Elcomsoft Mobile
- Chip-off rework station, JTAG box, ISP rig
- Manufacturer flash programmers
Standards we follow
Aligned to Canadian and international guidance.
- Faraday isolation protocols
- Canada Evidence Act s. 31.1 to 31.8
What you receive
Deliverables built for counsel, the regulator, and the court.
- A forensic image of the device (where the acquisition method permits a full image), hash-verified, retained on encrypted storage.
- A written examiner report covering scope, acquisition method, methodology, findings, and limitations.
- Decoded message threads, location plots, and timeline reconstructions as exhibits.
- An expert affidavit if the matter requires sworn evidence.
- A chain-of-custody record from intake through archive.
Common questions
Mobile Forensics questions from Canadian counsel and corporate clients.
Are screenshots of text messages admissible as evidence in Canadian court?
Screenshots can be tendered, but their weight is often challenged. A forensic acquisition of the source device is the more defensible path because it preserves message metadata, attachment hashes, and the raw database, which together establish authenticity under section 31.1 of the Canada Evidence Act.
Can encrypted messages from Signal or Telegram be recovered?
Often yes, when the device itself can be acquired. Both apps store decrypted message databases on the device for the user's own access. The challenge is acquiring the device with a high-fidelity method (full file system or physical), which our advanced extraction capabilities support.
What evidence can be extracted from a damaged phone?
It depends on the damage type. Water damage often leaves the memory chip intact and chip-off can recover almost everything. Fire and impact damage are more case-specific. We assess the device at intake and give a written feasibility opinion before any destructive work begins.
Is text message evidence admissible in BC court?
Yes, when collected through a defensible process and authenticated under the Canada Evidence Act. The strongest path is a forensic acquisition of the source device, supported by an examiner report or expert affidavit.
What is chip-off forensics, and when is it the right choice?
Chip-off is the technique of physically removing the memory chip from a phone and reading it directly with a specialized programmer. It is the right choice when the device is non-functional, when no software-level acquisition succeeds, and when the matter justifies destructive examination of the source device.
What is the difference between JTAG and ISP extraction?
Both are non-destructive board-level techniques for acquiring a forensic image without removing the memory chip. JTAG uses the device's manufacturer-defined debug port. ISP uses the eMMC test points directly. The choice depends on the device model and what access points are exposed on its board.
Related services
Often retained alongside mobile forensics.
Computer Forensics
Forensic imaging and analysis of Windows, macOS, and Linux systems for litigation, internal investigations, and expert witness work.
Explore serviceCloud Forensics
Defensible collection and analysis of Microsoft 365, Google Workspace, AWS, Slack, Teams, and Salesforce evidence under legal hold.
Explore serviceExpert Witness
Court-qualified expert witnesses delivering affidavits, expert reports, and trial testimony in Canadian civil and criminal matters.
Explore serviceHave a phone that needs forensic examination?
Tell us about the device and the matter. Our team will reach out as soon as possible.