Android and iPhone forensics: what actually differs

Published on 6 October 2026 · Author: Francesco Zinghinì

“Is it an Android or an iPhone?” is almost always the first question I am asked when a handset needs examining, and almost always the least useful one. The brand does enter the calculation, but well after three other things: the state the device arrives in, whether anyone knows the passcode, and whether a copy already exists somewhere else. This article sets out what actually decides the outcome, because arriving prepared for that conversation shapes an evidential strategy more than any tool does.

Why the brand is the least interesting variable

The two platforms have arrived, by different routes, at the same place: storage is encrypted by default and the key is tied to the user's passcode, held by a hardware component that will not surrender it on request. On iPhone that component is built into the processor; on Android it is an equivalent protected environment. From the point of view of whoever has to examine the device, the consequence is the same in both cases.

What genuinely varies sits one level down: the model, the operating system version and how current it is. A weakness that makes a device accessible exists for one precise combination of those three things, and disappears with the update that closes it. This is why two handsets of the same brand and the same age can give opposite results, while the average difference between Android and iPhone is far less pronounced than the folklore suggests. The fragmentation of the Android world adds variety — more manufacturers, more versions in circulation, more possible behaviours — but variety is not accessibility: it means a case-by-case check is mandatory and no general rule holds.

Anyone promising access to any handset, of any make, is selling a certainty the technique does not permit.

Device state: the variable that spends itself

This is the distinction that matters most, and also the one most often ignored, because it is counter-intuitive: a phone that is on and a phone that is off are not the same object, and the passage from one to the other runs in a single direction.

A device that has not been unlocked since it was last powered on keeps its encryption keys sealed: the storage is physically there but unreadable, and the examination reduces to a little system information. A device that is on and has been unlocked at least once has those keys in use: the content is decipherable for as long as that state lasts. The distance between the two conditions is enormous, and it is not a matter of having better tools.

The same reasoning applies to updates. A device that installs the update it is offered while waiting to be examined may close the very route that made it accessible. This is not a textbook hypothesis: it is one of the commonest ways in which a feasible examination becomes impossible while nobody appears to do anything wrong.

The passcode, and what to do without it

With the passcode, on either platform, the ordinary range of acquisitions opens up — and the discussion moves to how deep one can go, which I have set out on the mobile devices page. Without it, on a recent handset, the honest answer is that the content normally cannot be extracted.

Before treating the question as closed, though, it is worth reviewing who might lawfully know it or be able to obtain it. In family and employment disputes the passcode is frequently known to more than one person, or written down somewhere; on a corporate device there may be a management system that lets an administrator reset it. These routes are mundane, and for that reason they get skipped in favour of technical solutions that cost more and deliver less.

One clarification that heads off a recurring misunderstanding: resetting a passcode through a corporate management system, or restoring access to an account, are operations that act on the device. They should be decided in full knowledge of what they entail and documented like any other step — not performed on impulse because “it is our phone anyway”.

The copies that live elsewhere

When the device is inaccessible, the right question is no longer “how do I get into this phone” but “where else does what I need exist”. It is the reasoning that most often changes the outcome of an instruction, and here the two platforms have different habits.

On the iPhone side there is a well-established practice of local copies onto a computer, and such a copy — if one was made, and if it is protected by a password somebody knows — holds much of what would be sought on the handset, in a form already structured and analysable without touching the device. When an iPhone will not open, the first thing to establish is whether a forgotten copy already sits on a home or office computer.

On the Android side there is no equally widespread equivalent: the full local copy has been progressively restricted, and what remains is more often spread across the manufacturer's account, the operating system account and the services of individual applications. That makes the search more piecemeal, not empty: a synchronised gallery, a chat archive held by the service, an account's history may cover precisely the period at issue.

In both cases a warning applies that I have already put in writing about recovering deleted messages: what is obtained from an account or a backup is a representation of the data, and its weight in court depends on how it was acquired, not on the data being there. Downloading a folder and filing it is not an acquisition; the difference is made by the chain that ties the copy to its origin.

The tablet: the device nobody mentions

In the requests that reach me the tablet rarely features, and that is almost always a mistake. A tablet linked to the same account as the phone receives and keeps a copy of synchronised conversations, photographs and mail. It is used with less care than the device carried in a pocket, it is left at home, it is handed to the children — and it is practically never cleaned up when a dispute begins, because nobody thinks of it as a witness.

Technically a tablet is a mobile device like any other: everything said about encryption, state and passcode applies identically. Evidentially, though, it has two characteristics of its own worth exploiting. The first is that it is often less protected: a simpler passcode, updates neglected, sometimes no lock at all. The second is that, holding a synchronised copy, it can return a conversation that has been deleted on the phone — provided the tablet has not been connected to the network since the deletion, because synchronisation propagates deletions too.

The first minutes: what not to do

The moment a device comes into the hands of whoever will rely on it as evidence is the moment the worst damage is done, invariably in good faith. In order of seriousness:

• Do not switch it off and do not let it go flat. This is the point of the section above, and it remains the most expensive one.
• Do not update it, and decline the updates it offers.
• Do not try the passcode repeatedly. Beyond a certain number of failures many devices impose growing delays, and some, where the option has been enabled, erase the content.
• Do not sign the account out and do not change its password before the strategy is settled: doing so can cut off the very synchronisations from which the copies would come.
• Isolate it from the network, because a connected device can receive a remote wipe or propagate deletions made elsewhere. Flight mode is better than nothing; a shielded container is the correct answer when the device has to stay on.
• Do not let a trusted technician “have a quick look”. Every manual exploration alters the device and leaves traces that then have to be explained. That includes the screenshot taken just in case — on what a screenshot is worth on its own, I have written elsewhere.

Of all of this, the most useful thing to do is also the simplest: write down the state the device was in when it arrived — on or off, locked or unlocked, connected or not, at what charge — and who has handled it since. It is information that costs thirty seconds and is worth a great deal later.

What to ask, and in what order

Anyone framing a request for a technical examination of a mobile device — a question to an expert, an application to a court, or simply the first phone call — gets more useful answers if the questions follow this order, which mirrors the article:

1. Which device it is, on which system version, and when it was last updated.
2. What state it is in right now: on or off, unlocked since last power-up or not.
3. Who knows the passcode, or who can lawfully obtain it.
4. Which other devices and which accounts are linked, and whether a copy already exists on a computer.
5. What is being looked for and over what period — because that is the answer that makes it possible to work application by application and interval by interval, instead of extracting everything.

The first four questions determine whether the examination is feasible. The fifth determines whether it will be proportionate, and it is the one most often missing: a question drafted as “establish the contents of the handset” invites a full extraction that also returns the correspondence of people who are strangers to the proceedings, and exposes itself to objections a circumscribed question would have avoided.

Mobile devices: how I work → · Chat and messaging → · Back to insights