A. Data Extraction

• Police use Mobile Device Forensic Tools (e.g., Cellebrite, Magnet AXIOM) to create a forensic image of the phone’s data.
• This image allows experts to analyze the device without altering the original content.

B. Analysis

• Investigators search for specific types of evidence (e.g., texts, call logs, deleted files, GPS data).
• Data outside the scope of the investigation (e.g., personal photos or unrelated messages) should not be accessed unless explicitly allowed by the warrant or consent agreement.

C. Reporting

• A detailed forensic report is generated, documenting findings relevant to the case. This report may include timelines, metadata, and recovered files.