Attorneys and clients ask the same two questions about phones: how long will the exam take, and what can you actually get off the device?
There is no honest one-size answer. A locked handset with years of photos is a different job from an unlocked phone and a focused question about a few weeks of messages. What we can say up front is what drives the timeline, what an extraction can recover, and what it cannot.
What "phone extraction" means
In digital forensics, a phone extraction is a forensic copy of the data on a phone or tablet, taken with chain of custody so the original is preserved and the results can be used in a legal matter. It is not a screen-share, a home backup, or whatever you can see after typing a passcode.
Our mobile and email forensics work covers phones, tablets and related accounts. The same care applies when a computer or cloud account is part of a broader digital forensics engagement.
What a phone exam can recover
What turns up depends on the device, the software version, whether it is locked, and which extraction method is appropriate. In many examinations, relevant artifacts can include:
- Call history (incoming, outgoing and missed)
- Contacts and address-book entries
- SMS, multimedia messages and many app-based chats
- Photos, videos, audio and sometimes voicemail
- Internet browsing history, search history and related records
- Notes, calendars and other user-created files
- Historical location and Wi-Fi connection information
- Data from installed apps, when it is recoverable
- System logs that help build a timeline of activity
- Deleted data, when remnants remain on the device
That list is what examiners look for when the device and method allow it — not a promise that every item is available on every phone. Encryption, software updates, app design and device condition all affect recovery.
If the question is whether someone is watching a phone, that is a different exam. See our hacked or monitored phone service.
How long it usually takes
Clients often hear that "the extraction" is the whole job. In practice it has several stages, and the extraction itself is only one of them:
- Intake — the device is logged and chain of custody begins.
- Preserve — condition is documented and the device is protected.
- Extract — a forensic copy of the data is made.
- Analyze — we search the copy for what answers your question.
- Report — findings in plain language, with exhibits as needed.
Extraction can be relatively short on a cooperative, unlocked device, or much longer when the phone is locked, damaged, or holds years of media. Analysis and reporting are often the longest parts, because that is where an examiner turns raw data into answers counsel can use.
We give a clear estimate after we understand the device, the access available and the questions that matter. Many matters can start once the device is in hand or collected remotely.
What affects the timeline
Several factors change how long the work takes:
- The phone itself — make, model and software version.
- Locked or unlocked — whether a passcode is available.
- How much is stored — years of photos and chats take longer than a few weeks of texts.
- Type of extraction — deeper methods can reach more data and take more time.
- Device condition — cracked, wet, or a phone that will not power on.
- Accounts off the phone — cloud email and other accounts are often a separate step.
- Your question — a focused question is faster than "get everything."
- Analysis and report — often the longest part of the job.
Damaged phones are not automatically a lost cause. Phones that were dropped, soaked or burned can still hold evidence.
What a phone exam cannot do
A careful exam also has limits. It cannot invent data that was never stored, reverse strong encryption without credentials, or guarantee that every deleted message still exists. And it cannot turn a vague request into a useful report without a clear question.
When the other side already produced a report, our role may be to review it and explain what the findings do and do not show — work that sits alongside expert testimony and litigation support.
Remote collection when travel is not practical
Not every phone has to come to our office on day one. For custodians in other locations or multi-state cases, we can often collect evidence remotely while keeping it court-ready. See remote evidence collection.
How this looks in practice
In one engagement, a private client suspected malware across several devices and their network. We shipped a secure collection kit, reviewed the network remotely, examined each device, and delivered a separate findings report for each. Identifying details were changed for confidentiality; see the multi-device malware case study.
In another matter, in-house counsel found a covert recording device used to secretly record an employee. We imaged the device and related media, recovered deleted files, built a timeline, and returned the evidence with documented chain of custody. See the covert recording device case study.
What to do before you send a phone
A few steps help preserve evidence:
- Stop using the phone for new activity if the matter is active.
- Do not factory-reset the device or "clean it up" first.
- Note the passcode if you know it, and whether biometrics are enabled.
- Keep the phone powered if possible.
- Tell us the questions that matter (messages with a person, or activity in a date range).
- Work through counsel when the matter is in litigation.
Talk to an examiner
If you need a phone examined for a case, or you are deciding whether a forensic extraction is the right next step, call us. Every conversation is confidential.
- New York: 631-982-4632
- Boca Raton, FL: 561-825-0872
- Hours: Monday–Friday, 9 AM–5 PM ET
- Request a confidential consultation
Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide digital forensics, OSINT, investigations, cybersecurity and managed IT, with remote support anywhere in the U.S. and worldwide.
Originally published on the Executive Digital Group website on October 19, 2026.