Define the examination
Start with the event, time period or records you need to understand. We agree which devices and applications are relevant, what consent covers and which data falls outside the work.
This helps a legal team assess a disputed communication, a corporate investigator examine reported misconduct, or an incident-response team review the mobile part of a wider matter.
Check the available evidence
Depending on the device and method, an examination may include:
- Messages, call records and related metadata.
- Photographs, videos and other files.
- Application databases and activity records.
- Browser history, device events and available location records.
Support varies by exact model, operating system, app version, lock state and available credentials. Deleted records may be unavailable. We discuss these constraints before accepting the examination.
Follow the work
Consent & scope
Confirm documented consent, the questions to examine and any limits on access. Agree the handling arrangements and expected outputs before the device changes hands.
Acquisition
Choose a supported method and record the device details, operator actions and outputs. Some mobile acquisition methods change device state; we document the method and relevant changes.
Analysis
Check relevant records, compare timestamps and connect events where the available evidence supports it. We separate observed facts from interpretations and consider gaps that could affect the answer.
Report & handover
Explain findings with source references, methods and material limitations. Complete the agreed handover and follow the retention or return arrangements.
Agree what you will receive
The proposal identifies the outputs for your matter. These can include a findings report, relevant exports, a record of evidence received and produced, and a technical appendix for review.
The proposal will state whether hashes are produced, which algorithm is used and which file or output is hashed.
Common questions
Can you examine any Android phone or iPhone?
We check each device before agreeing the work. Send the exact model, operating system if known, current condition and whether credentials are available. We can't promise access or data recovery before that check.
Can you recover deleted messages?
Recovery depends on the application, storage behaviour, encryption, backups and examination method. Some deleted records cannot be recovered. We state what the available material supports.
Can I commission an examination without the owner's consent?
Zeno's mobile examination service is consent-based. We require documented consent appropriate to the device and agreed work before accepting it.
Can your report be used in a legal matter?
Tell us about the intended use when we scope the work so your legal team can specify its requirements. We document the examination and findings; acceptance of a report is a decision for the relevant court or forum.
Do you handle cloud accounts or laptops as part of the examination?
The service covers supported Android and iOS devices. We agree any use of existing exports separately. Laptop acquisition, server investigations and cloud-account collection are outside this launch service.
Discuss your examination
Send the device details, relevant dates and a short description of the question. We will confirm the information needed to assess feasibility.
Keep evidence and passwords out of the enquiry form. We agree a transfer method after scoping.