Logical extraction
Acquisition through the operating system and supported interfaces, including contacts, messages, media and backups. Only data accessible to the selected method is read.
Digital forensics · Kraków / Poland-wide
Phone and mobile device analysis
Acquisition and analysis of available Android and iPhone data, backups and extraction files. Analysis may cover communications, apps, files, metadata and activity timelines, within the assignment’s questions and the device’s technical capabilities.
Request an analysis or expert opinionFrom device to examination material
Phone data extraction methods
The method depends on the model, operating system, security patches and device condition. The acquisition scope is recorded in the examination documentation.
File system and full file system
Examination of directories, application databases and configuration files. Broader access to protected areas requires a supported method and appropriate permissions. This is not the same as a physical memory image.
Physical extraction
A binary image of memory or its partitions, available for supported devices. MOBILedit describes methods involving MTK chipsets and EDL mode. Encryption can still limit access after imaging.
For iPhone, I distinguish backups, available logical data and imported file system extractions. MOBILedit does not support physical extraction of iOS devices. No method guarantees recovery of all deleted data.
Documentation that makes results verifiable
The material description, sequence of actions, tool version, method and hashes of captured files make the examination traceable. Interpretation considers source databases, metadata, time zones and consistency. Tool output is distinguished from expert conclusions.
Manufacturer documentation: logical extraction · file system · physical extraction. Checked on 13 October 2026.
Scope of mobile data analysis
The scope is determined by the assignment, available material and supported acquisition methods.
- Messages, call logs and available messaging app data.
- Photos, recordings, documents, attachments and their metadata.
- Backups, application databases and user activity traces.
- Event timelines accounting for timestamp sources and meaning.
Analysis of a child’s phone
I examine available data from a child’s phone, including browsing history, for signs of inappropriate or potentially illegal content and risks in communications. I explain the findings and the limits of the analysis in clear terms for a parent or guardian.
The examination may cover retained web addresses and visit dates, available messages, attachments and files relevant to the concern. I agree the scope with a parent or guardian after confirming authority to access the device and data, with regard for the child’s privacy. Availability depends on the device, applications and how data was recorded; browsing history may be incomplete, and an entry alone does not establish who used the phone.
I agree the scope individually, taking into account the available data, authority to provide and use it, the purpose of the work and its legal basis. Before work begins, I explain the possibilities and limitations and provide a tailored quote.
Extraction and identification of data sources
Method selection considers the phone model, Android or iOS version, device condition and security. The report identifies record sources and the material accessible through the chosen method.
MOBILedit Forensic ULTRA
MOBILedit Forensic ULTRA supports acquisition, analysis of supported apps and reporting. Data and tool reports are interpreted alongside the other material. Readout and recovery depend on the specific device.
Documentation and limits of findings
Analysis considers origin, consistency and technical limitations. A single record, contact number or timestamp does not by itself establish who acted or what happened; correlation with other information is essential.
Information needed to assess the assignment
Include the device model and condition, data sought, technical questions and available backups. Transfer of the phone or digital material is agreed individually.
Enquiries and assignments
Contact about an analysis or expert opinion
I welcome courts, police and prosecutors. Prompt deadlines are agreed after assessing the material and scope. Please describe the assignment, available devices or data, and questions for the opinion.
ul. Kielecka 2/53, 31-526 Kraków · Rondo Mogilskie
Assignments across Poland · meetings by appointment
View location on the map ↗
Map and distances to Kraków courts
Details for an initial assessment
Describe the device or medium, the issue and the questions to be answered. Details of available data copies will help establish the scope.
Prepare an enquiryWe will agree the material transfer and deadline individually.