If you’re new to mobile forensics, begin with a high-level explanation of what examiners do, what “artifacts” are, and why acquisition method matters.

• What is cell phone forensics and how does it work? — the foundation page for terminology, workflow, and realistic expectations.
• Cell phone forensics overview — the primary hub page tying the topic cluster together.

Preservation is the difference between “usable evidence” and “a device that was altered during troubleshooting.” This guide focuses on defensible handling steps and common mistakes.

• Evidence preservation for cell phones (what to do and what to avoid) — practical guidance for preserving timelines, accounts, and artifacts.
• For broader context on how preservation fits into the full workflow, refer back to cell phone forensics.

“Logical vs file system vs full file system” labels often cause confusion. This guide explains what those terms usually mean, why modern encryption limits “physical” on newer phones, and why AFU is typically preferred over BFU when lawful.

• What is a cell phone forensic extraction? (logical vs file system vs full file system vs physical, AFU/BFU) — plain-English definitions plus practical implications for evidence completeness.
• For a broader tool ecosystem view (and why vendors label methods differently), see cell phone forensic tools & software.

Mobile forensic work is not “one tool = one answer.” This guide explains common forensic tool categories, core terms, and why validation and limitation statements matter in defensible reporting.

• Cell phone forensic tools and software (terminology, capabilities, limitations) — a practical map of the ecosystem and key report language.
• If you want the broader workflow that these tools support, see what cell phone forensics is and how it works.

iPhone forensics is shaped by hardware-backed encryption and device state. These pages cover iOS evidence categories, artifacts, and how investigations interpret suspicious activity signals with restraint.

• Understanding iPhone forensic analysis (iOS artifacts, encryption, AFU/BFU concepts) — iOS fundamentals without focusing exclusively on “hacking” narratives.
• iPhone hacking investigations (iOS forensic analysis evidence) — suspicious activity and compromise indicators explained using verifiable iOS artifacts.
• For the main hub context, reference cell phone forensics.

Android varies heavily by manufacturer and build. These pages focus on Android architecture, file-based encryption (FBE), and Android-specific artifacts like usage and wellbeing context.

• Android forensic analysis guide (FBE, logs, Digital Wellbeing, USB debugging) — Android evidence structure and common forensic artifact categories.
• Android hacking investigations (Android forensic analysis) — suspicious activity and compromise indicators in Android terms (rooting, policy changes, risky configuration).
• For the main hub context, reference cell phone forensics.

Many “phone hacking” stories are actually account compromise stories driven by S