When text messages could make a difference in your case, you need to know what can be preserved, how to obtain it and what your client should expect. We help litigation lawyers turn relevant SMS, WhatsApp and WeChat conversations into clear, verified records for legal proceedings.
This guide explains the extraction appointment, the analysis that follows and how to help your client prepare, with a downloadable reference to keep or share.
How we help: We understand what your case needs, then recommend a clear plan for getting the best available evidence as efficiently and conveniently as the circumstances allow.
1. Start with what your case needs
We start with a conversation about what you need to establish, the people involved and the relevant dates. You do not need to choose an extraction method or know where every record is stored. We help identify useful sources, including SMS or iMessage, WhatsApp, WeChat, related phones and authorized backups, and discuss whether deleted messages matter.
Before work begins, we agree what evidence to collect and what you need for review. We also discuss authority to collect it, privilege, confidentiality and your deadlines, so our plan reflects both the needs of your case and your client's privacy.
2. Preserve the evidence and understand the records
We collect accessible phone data using a supported forensic method, commonly called an extraction. We document the device, method and relevant handling information, record applicable integrity checks, and store the acquired evidence on encrypted evidence-storage drives.
Once the extraction is complete, we take the collected data back to our office for digital forensic analysis. We identify the conversations relevant to your case and prepare clear, verified records for your review and use in legal proceedings. We explain what we find and any important gaps, so you can assess the evidence with confidence.
Planning your time: The phone appointment is for collecting the data. Processing, digital forensic analysis and preparation of your records or report follow after the extraction appointment.
3. We recommend the method that fits your needs
An advanced logical extraction can reduce extraction time and be an efficient first choice when it captures the current records your case needs and deleted-data recovery is not required. We check what is available for the particular phone, software and applications before recommending this approach.
Full file-system extraction can provide additional current app data, databases, logs or metadata that a logical method cannot reach. Physical extraction is more restricted on many modern encrypted phones.
| Method | What it generally acquires | When it may fit | Important limits |
|---|---|---|---|
| Advanced logical | Accessible records through supported interfaces, backups or tool-specific logical methods. | Focused current communications when the target data is supported. | May omit relevant app databases, system records or metadata. |
| Full file system (FFS) | Available files, potentially including app databases, logs and richer metadata. | App or system records beyond logical coverage; examination of available remnants. | Requires supported access. Not universally available or a copy of everything. |
| Physical | Accessible storage at a lower, bit-level acquisition layer. | Device-specific cases where this method is feasible and useful. | Modern-device restrictions and encryption can limit access and interpretation. |
If deleted messages are important, we will explain what recovery options are realistic. No method guarantees their recovery; retention, encryption and what remains on the device all matter.
4. Plan the appointment around your deadlines
Many DFI phone extractions take approximately 1.5–2 hours. This is a useful starting point for planning, rather than a fixed appointment length.
Storage capacity, how full the phone is, data type, the extraction method and technical issues can extend the appointment. Processing, digital forensic analysis, verification and preparation take additional time.
Let us know about disclosure dates or other deadlines when we first speak. We can explain the time involved in preparing selected communications or a detailed expert report and help you plan the next steps.
A practical reference for your legal team
Mobile Phone Evidence for Litigation
A practical guide to preserving phone evidence, preparing for an extraction and understanding the records your case needs.
Download the PDF guide (opens in a new tab)PDF · 4 pages5. We help you get ready for the appointment
We will explain what the owner needs to do for their particular phone before the appointment. Please review these required preparation steps with your client. We will confirm which settings changes their phone and extraction method need.
Before your extraction
Do not update iOS before the extraction
Please wait until the extraction is complete before updating the iPhone’s iOS version. An update may limit the supported extraction options. If an update is already scheduled, contact us before the appointment.
iPhone: Stolen Device Protection
If this protection needs to be disabled for the planned extraction, we ask the owner to address it at least 24 hours before the appointment. This is DFI's preparation window. Apple's delay is generally one hour for certain protected changes, depending on location and settings.
Samsung: Auto Blocker
This feature can block USB commands and may need to be temporarily disabled by the owner. Samsung's optional “Turn On Automatically” setting, introduced in One UI 8.5, can re-enable it after 30 minutes; this is not a universal timer on all Samsung phones. We will help coordinate the timing.
Please change either security setting only after we confirm it is needed, and restore protection when advised after the work. Check with us before resetting the phone or using recovery tools. For security, keep passwords and evidence out of the general website inquiry form.
6. Receive verified records your legal team can use
We identify the relevant SMS, WhatsApp, WeChat or other available conversations and check the selected output against the examined source records. Depending on the source, those records may include account identifiers, timestamps, surrounding messages and attachments.
We discuss how you intend to use the evidence and agree the dates, format and any privilege-review or redaction process with you. You may need selected communications, a chronology or a forensic report explaining our methods and findings. We help prepare those materials while counsel directs the legal production requirements.
Verification and integrity checks support scrutiny of the records; they do not alone establish authorship or the truth of a message. Records are prepared for use in legal proceedings, but admissibility remains a decision for the court.
Questions litigation lawyers often ask
Is full file-system extraction always necessary?
No. Advanced logical may be sufficient if it captures the relevant records. We will explain whether FFS could add useful current app data or metadata, even where deleted material is not in issue.
Can you help check an existing PDF or screenshot?
We can assess whether it can be compared with lawfully available source records. Keep the received file and tell us what is disputed. Read When a PDF of Text Messages Is Disputed.
Schedule your extraction with DFI
Tell us what you need for your case. We’ll help you prepare your client’s device and arrange the right extraction.
Schedule your extraction with DFI Start with a consultation so we can confirm your needs and appointment details.Related services: mobile device forensics · messaging-application evidence · digital forensics for lawyers.
General information, not case-specific forensic or legal advice. An article does not establish an engagement. App names and marks identify potential evidence sources; no affiliation or endorsement is implied.
