Case Type: Criminal Law

Client: Defense Law Firm (anonymous)

Parties Involved: Public Prosecutor vs. Defendant

Mandate Assigned to H2E Firm:

Extraction and analysis of deleted messages from an iOS device seized by police

Duration of Mandate: 20 business days

Context

In a case involving accusations of threats and harassment, the public prosecutor relied on a partial set of text messages extracted from an iPhone provided by the complainant.

The defense attorney suspected that key contextual elements — especially earlier messages indicating consensual exchanges — had been deleted or omitted from the evidence submitted by the prosecution.

He commissioned H2E Firm to conduct a full extraction of the device seized from the accused to verify the presence of deleted or undisclosed messages.

H2E Firm’s Intervention

Step 1

Reception and Securing of the Device

  • Documentation of chain of custody

  • Full photographic documentation and model identification

  • Creation of a complete forensic image of the iPhone, without altering its content
Step 2

Extraction and Analysis

  • Use of Cellebrite UFED to extract deleted data

  • Processing of SQLite databases (SMS, iMessages, MMS, contacts, logs)

  • Reconstruction of partially deleted conversations

  • Verification of timestamps and metadata to detect tampering
Step 3

Report and Deliverables

  • Detailed report with chronological comparison between the prosecution’s submitted evidence and the actual messages found on the device

  • Identification of over 40 deleted messages showing cooperative and consensual tone between both parties prior to the complaint

  • Report written in a neutral, simplified format with included text excerpts and reconstructed visual captures

Result

The defense attorney used the report to request a
cross-examination on the reliability of the digital evidence.

The judge authorized the submission of H2E Firm’s report, and the complainant admitted to having deleted certain messages before handing over their phone to the police.

The public prosecutor withdrew part of the charges, stating that the overall context no longer aligned with the initial version presented.

Takeaways

  • Partial digital evidence can mislead a court, even without deliberate falsification
  • Deleted messages can often be recovered, even after some time has passed
  • A rigorous but clear and accessible technical report can dramatically change the direction
of a case

Tools Used

Cellebrite UFED
SQLite Browser
Custom forensic timeline (H2E Firm)
SHA-256 for integrity validation

Do you have a case?

Submit it securely using our platform.

No emails. No delays. Use our dedicated submission system to get expert help fast.

Submit Your Case

Your information is kept confidential and reviewed by certified experts.