Cell Phone Data Categories & Rationale
1. Electronic Communications
Includes: SMS, MMS, iMessage, WhatsApp, Messenger, Signal, Telegram, and other chat apps.
Rationale: Provides conversations with suspects, timelines of communication, potential admissions, consent or lack thereof, threats, and corroboration of events.
2. Call Logs & Contacts
Includes: Incoming, outgoing, and missed calls, plus saved and synced contact lists.
Rationale: Establishes communication patterns, frequency of contact, relationships, and corroborates other evidence.
3. Photos, Videos & Media Files
Includes: Camera roll, downloaded media, cloud-synced albums, thumbnails, and deleted/recovered files.
Rationale: May contain direct evidence of the crime, images of injuries, suspects, or corroborating context.
4. Location Data & GPS History
Includes: GPS history, Google Maps data, cell tower pings, Wi-Fi networks, geotags in photos.
Rationale: Demonstrates presence at a scene, supports or disproves alibis, and reconstructs movements.
5. App Data & Social Media
Includes: Social media apps, dating apps, ride-sharing apps, and financial/payment apps.
Rationale: Shows communication, social connections, financial transactions, or digital activity relevant to the investigation.
6. Internet Activity
Includes: Browser history, cookies, cache, bookmarks, and search queries.
Rationale: Reveals intent, research before or after an offense, and corroborates suspect behavior.
7. System & Deleted Data
Includes: Deleted files, temporary data, logs, device backups, and forensic artifacts.
Rationale: Shows attempts to conceal evidence, provides additional hidden data, and preserves integrity of analysis.