fatcousin
// case type

mobile device triage (consent-based)

consensual scan of a phone for the basics — apps, messages, location, recent activity. small-org IT, lawyers, or DV advocates.

tools
15
priority
M
processing
local · in browser

start here · primary tools

ordered. work top-down. the first tool is the suggested entry point for this case type.

  1. ios backup browserdrop an iTunes backup Manifest.db · list backed-up apps · files · domains · relative paths · export CSV · runs locally
  2. ios backup analyzerdrop an ios backup manifest · browse file structure · extract app data · databases · runs locally
  3. android backup analyzerdrop an android backup ab file · browse app data · extract databases · files · shared preferences · runs locally
  4. ios spotlight search artifact extractordrop ios spotlight sqlite or interactionc database · extract spotlight search queries · reconstruct what the user searched for on device · surface app launches via spotlight and searched contact names · runs locally
  5. ios screen time forensic analyzerdrop screen time sqlite from ios backup · app usage · website visits · pickup frequency · digital activity · alibi assessment · runs locally
  6. ios app install and uninstall timeline reconstructordrop manifest db applicationstate plists installd log · install uninstall upgrade timeline · mass uninstall alerts · runs locally
  7. android logcat analyzerdrop android logcat output · parse log levels · crash detection · anr · security exceptions · network activity · timeline · runs locally
  8. mobile location history extractordrop ios locations sqlite · google location json · csv gps · haversine stops · movement timeline · runs locally

also useful · secondary tools

supporting and follow-up tools. surface as the investigation widens.

  1. ios photos database forensic analyzerdrop photos.sqlite · metadata including deleted · location · hidden photos · creation timeline · runs locally
  2. ios notes complete forensic analyzerdrop notestore.sqlite · notes including deleted · locked metadata · attachments · sensitive content scan · runs locally
  3. ios call history parserdrop ios callhistory storedata sqlite · parse all call records · reconstruct call timeline · identify frequent contacts unknown numbers and voip calls · surface deleted call gap analysis · runs locally
  4. ios sms database parserdrop iOS backup SMS.db · threaded conversation view · timestamps · attachments · participants · export CSV · runs locally
  5. android sms database parserdrop Android mmssms.db · parse SMS and MMS threads · contacts · timestamps · export conversations as CSV · runs locally
  6. android call log parserdrop Android contacts2.db or calllog.db · parse incoming · outgoing · missed calls · contacts · duration · timestamps · export CSV · runs locally
  7. case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
// case-kit pipeline

run as a stack

skip the click-through. these presets are curated forensic pipelines you can save as a stack with one click and run on your evidence locally.

  • mobile triage — consent-based kit

    6 steps

    drop APK/IPA packages + location exports → app analysis → location history → unified timeline → report

    1. 01evidence-manifest-generatorhash every file before triage — consent-based cases still need integrity
    2. 02apk-analyzerandroid packages: permissions, dex strings, network security config
    3. 03ipa-analyzerios packages: entitlements, URL schemes, embedded frameworks
    4. 04mobile-location-history-extractorparse location history exports when provided alongside the app packages
    5. 05forensic-timeline-buildermerge timestamped events from all artifact bundles into one timeline
    6. 06case-report-generatordraft a plain-language triage summary for IT, counsel, or advocates
// pattern-matched

related tools

tools that the manifest-classifier flagged as plausibly useful here but that aren't in the hand-curated lists above. less editorial weight — scan, don't work top-down.

+ 207 more in this pattern match. browse the full forensics catalog via the forensics category.

ready