Six Steps To Successful Mobile Validation

Six Steps to Successful Mobile Validation, published by SANS Institute in May 2021, is a practitioner methodology written jointly by 16 digital forensics experts, including Heather Mahalik, Jessica Hyde, Alexis Brignoni, Oleg Skulkin, and colleagues from Cellebrite, Magnet Forensics, MSAB, Oxygen Forensics, ElcomSoft, and law enforcement backgrounds. The paper sets out a six-step framework for extracting, validating, and reporting mobile device evidence in a way that will hold up to legal and technical scrutiny.

The Six Steps:

1. Determine all possible extraction methods for your search authority, starting with the safest method and working toward the most comprehensive, while confirming legal authorization and minimizing unnecessary interaction with the device before extraction
2. Process the data in more than one tool, comparing artifact results across tools for anything considered essential evidence and understanding how each tool deduplicates, filters, and timestamps data
3. Conduct deep dive forensics once automated tools reach their limits, manually verifying whether artifacts are legible, contextually consistent, and correlated to the investigation's timeframe
4. Validate findings through visual, cross-tool, call detail record, CCTV, carving, or replication methods, tracing artifacts back to their source file and confirming timestamp accuracy against device local time, UTC, and time zone changes
5. Report and share findings by highlighting only evidence relevant to the investigation, validating what is reported, and distinguishing factual findings from opinion
6. Commit to ongoing education, since digital forensics and incident response (DFIR) is a fast-moving field where accepted practices, such as whether to power down a device or remove its SIM card, change over time

The authors frame mobile forensics as a discipline that sits between science and art: automated extraction tools can only go so far, and it is manual verification, cross-tool comparison, and disciplined documentation that make a forensic finding defensible in court, sometimes years after the original investigation. Not every case requires all six steps; the paper recommends scaling the depth of validation to the stakes of the investigation, reserving the full sequence, including deep-dive artifact validation and cloud data extraction, for major crimes cases where the evidence may be contested. The paper was authored collaboratively across law enforcement, forensic tool vendors (Cellebrite, Magnet Forensics, MSAB, Oxygen Forensics, ElcomSoft, Paraben, Belkasoft, Grayshift), and independent forensic researchers and instructors, reflecting practices drawn from casework across multiple jurisdictions and legal systems.