The instructions that produce useful reports have four things in common: a clear question, a preserved device, a proportionate method and a court-ready deliverable. Everything a competent expert does is in service of one of those four.
What the expert actually delivers
- 01Scoping. A short conference before the instruction is finalised, to identify which factual assertions in the case can be tested against device data, and which cannot. This shapes what the report should answer and what it should decline to answer.
- 02Preservation. Isolating the device from the network, documenting its state, and taking a forensic image to a standard that survives cross-examination on the chain of custody.
- 03Extraction. To the depth the case requires, and no further. A logical extraction is often proportionate for visible messages; full file system or physical extraction is reserved for questions of deletion, denial or hidden content.
- 04Analysis. Working exclusively on the image, reconstructing conversations, timelines, locations and application activity. Every conclusion tied to a specific artefact, so the reasoning is auditable.
- 05Reporting. CPR Part 35 (civil), CrimPR Part 19 (criminal) or FPR Part 25 (family) compliant, with a plain-English executive summary a judge can follow and a technical annexe an opposing expert can test.
- 06Cross-examination support. Attendance at court to defend the methodology under questioning, and — where necessary — joint statements with the opposing expert under CPR Part 35.12.
How solicitors and clients get the best value
- Instruct early. Preservation done in the first week of a matter is almost always cheaper than reconstruction done in the last week before trial.
- Send the four essentials: the questions in issue, the device, any known passcodes recorded separately, and the deadline.
- Give the expert the pleadings, not a summary. What matters is what has actually been asserted, not what the client thinks is important.
- Ask for a preliminary opinion on scope before commissioning the full report; a short call often halves the eventual cost.
- Do not let anyone — client, family member, in-house IT — "have a quick look" at the device before it arrives at the laboratory.
What separates a defensible report from a fragile one
Any competent laboratory can produce an extraction. A defensible report goes further: it concedes the limits of the method as clearly as it sets out its findings, it ties every conclusion to a specific artefact with a specific timestamp, and it explains the artefact in language a lay reader can follow. The strongest reports are the ones the opposing expert cannot dismantle, because there is nothing over-claimed to dismantle.
A mobile phone expert's job is to explain, not to advocate. The reports that survive scrutiny are the ones written as if the opposing expert will read every sentence — because, in a contested matter, they will.
Common instructions we see
| Forum | Typical question | Method usually proportionate |
|---|---|---|
| Criminal defence | Was this message sent by our client, and can it be dated? | Full file system or physical extraction; message-level attribution |
| Family Court | Do the messages in the bundle reflect the whole conversation? | Logical or full file system; reconciliation against the other party's device |
| Employment | Did the departing employee exfiltrate confidential data via WhatsApp? | Full file system; media, contacts and Wi-Fi association timeline |
| Commercial | Are the screenshots exhibited authentic and complete? | Logical extraction of the source device; hash-verified reconciliation |
| Harassment / stalking | Who is behind the messages, and are they from a known device? | Physical extraction; account identifiers, IMSI, IMEI, push tokens |
Frequently asked questions
Most focused single-device instructions can be scoped and quoted within a working day. Extraction takes hours to days depending on method; reporting typically one to two weeks from receipt of the device.
Yes, on criminal defence and family matters where legal aid is in place. A prior authority is normally required for the full instruction; a preliminary opinion can often be delivered within scope.
Rarely with useful results. A factory reset destroys the encryption keys required to decrypt user data, and modern devices actively wipe the underlying storage. Preservation before reset is decisive.
Yes. The author of the report attends to defend it. Junior examiners do not sign reports they cannot stand behind in cross-examination.
Yes. Every civil report includes the statement of truth, the expert's declaration, a list of material considered and a plain summary of methodology. Criminal and family reports comply with CrimPR Part 19 and FPR Part 25 respectively.