Overview#
A homicide detective hands an examiner a locked iPhone recovered from the scene. The victim's last known movements, final messages, and location history are all potentially on that device. The examiner applies a file system acquisition, decrypts the keychain, and within the hour has a complete timeline of the victim's activity: messages with the suspect, GPS coordinates from Apple Maps, a photo taken 400 metres from where the body was found, and deleted Signal messages recovered from the SQLite WAL file. Mobile devices hold a more complete record of human behaviour than almost any other evidence source.
Argus Mobile Forensics gives digital forensics units, corporate security teams, incident response specialists, and eDiscovery professionals the tools to extract that evidence completely, analyse it systematically, and present it in formats that courts across jurisdictions accept. The platform supports thousands of device models, multiple extraction methods per device, and automated analysis that surfaces relevant findings from enormous artifact sets.
Open Standards#
- ISO/IEC 27037:2012: The platform's evidence acquisition, Bates-numbering, and export workflows explicitly comply with this international standard for the identification, collection, acquisition, and preservation of digital evidence, ensuring court-admissible handling procedures.
- PDF/A-3 (ISO 19005-3:2012): Forensic reports and evidence packages are exported as PDF/A-3 archival documents, embedding raw artefact files alongside the rendered PDF for long-term preservation and cross-jurisdictional court admissibility.
- RFC 3161 (Trusted Timestamping): Evidence manifests and package hashes are anchored to an external Timestamp Authority using RFC 3161 tokens, providing a cryptographically verifiable proof of existence at a precise point in time.
- SHA-256 (FIPS 180-4): All evidence items, chain-of-custody events, and export manifests carry SHA-256 digests that form a Merkle-chained audit ledger, enabling tamper detection and integrity verification at every stage of the examination.
- CMS / PKCS#7 (RFC 5652): Detached CMS signatures are applied over export manifests and disclosure bundles, allowing recipients to verify the examiner's identity and confirm that no artefact was altered after sealing.
- Exchangeable Image File Format (Exif / JEITA CP-3451C): GPS coordinates, timestamps, and camera metadata embedded in photos and videos recovered from mobile devices are parsed using the Exif standard, surfacing location and time evidence for timeline reconstruction.
- CJIS Security Policy (FBI): Evidence handling, access control, audit logging, and digital-media retention procedures comply with the FBI Criminal Justice Information Services Security Policy, meeting the requirements of law-enforcement agencies in the United States.
- FRE 901 / FRCP 34: Evidence authentication and eDiscovery exports are structured to satisfy Federal Rule of Evidence 901 authentication requirements and Federal Rule of Civil Procedure 34 production obligations, supporting use in both criminal and civil proceedings.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14
Key Features#
Device Support and Extraction#
- Universal device support across thousands of iOS and Android device models spanning multiple generations.
- Advanced iOS extraction covering file system acquisition, keychain decryption, and logical methods that do not require jailbreaking.
- Locked device acquisition for select Android devices and iOS accounts without user credentials or passcodes.
- Cloud backup acquisition downloading complete iCloud backups and Google account data without physical device access.
- Multiple extraction methods providing the flexibility to match the appropriate technique to each device scenario.
Data Recovery and Analysis#
- Deleted data recovery reconstructing messages, photos, app data, and browsing history months after deletion.
- Encrypted app analysis decrypting and parsing databases from hundreds of messaging applications with full conversation reconstruction.
- Comprehensive artifact parsing for system logs, app caches, deleted databases, and temporary files.
- AI-powered intelligence surfacing relevant evidence and detecting anti-forensic techniques across large artifact sets.
- App-specific parsers for hundreds of social media, messaging, and productivity applications.
- Multi-device correlation linking evidence across multiple devices belonging to subjects and associates.
Timeline and Activity Reconstruction#
- Automated timeline reconstruction correlating call logs, messages, location data, app usage, and media creation events.
- Activity pattern analysis showing daily routines, communication habits, and behavioural changes over time.
- Contact network analysis mapping relationships based on communication frequency and patterns.
- Browser forensics extracting browsing history, bookmarks, saved passwords, and cached content.
- Bluetooth and Wi-Fi connection history revealing device proximity and network associations over time.
Evidence Integrity#
- Chain of custody automation with evidence tracking, hash verification, write-blocking, and tamper-evident audit logs.
- Standardised forensic reporting meeting court admissibility requirements across jurisdictions.
- Examiner workflow documentation capturing every step of the extraction and analysis process.
- Selective reporting capabilities for scope-limited warrants and privacy-compliant evidence presentation.
- Quality assurance processes with peer review and supervisory verification of findings.
- Court testimony preparation tools with evidence summary generation and exhibit organisation.
Use Cases#
Digital Evidence Collection. Perform forensically sound extraction of mobile device data with proper chain of custody, hash verification, and documentation that maintains evidentiary integrity for prosecution. Process devices efficiently while maintaining the highest forensic standards.
Encrypted Communication Recovery. Decrypt and reconstruct conversations from secure messaging applications to reveal communications relevant to investigations, even when suspects believe messages are permanently deleted. Access evidence from the most commonly used encrypted platforms.
Timeline and Activity Reconstruction. Automatically correlate data across calls, messages, apps, location services, and media to build comprehensive activity timelines showing subject behaviour and movements. Present clear chronological narratives for investigation and prosecution.
Multi-Device Investigation. Analyse multiple devices from subjects, victims, and witnesses to identify communication patterns, establish relationships, and build complete investigative pictures. Cross-reference evidence across devices for comprehensive case analysis.
Integration#
- Connects with evidence management and chain of custody systems for secure evidence preservation.
- Integrates with investigation and case management workflows for seamless evidence delivery.
- Links to timeline reconstruction and analysis platforms for multi-source evidence correlation.
- Works with cloud service provider data request processes for complementary evidence collection.
- Supports export of forensic reports in court-admissible formats across jurisdictions.
- Feeds into analytical tools for cross-case pattern identification and evidence correlation.
- Connects with cellular network providers for tower dump processing and analysis.
- Supports vehicle infotainment system forensics for connected car evidence extraction.