Every ExtractPhone report follows a standardized structure modeled on accepted digital forensic reporting conventions. Each section serves a specific evidentiary purpose. Understanding what each section contains helps you locate data quickly and respond to opposing challenges.
Cover Page
Displays case number, examiner name and firm, date of examination, classification level (e.g., Attorney-Client Privileged), and the ExtractPhone version used. Serves as the formal title page for court filing.
Table of Contents
Auto-generated with accurate page numbers for every section and subsection. Facilitates navigation during depositions and hearings.
Executive Summary
A one-page overview of the evidence dataset: total record counts by type, earliest and latest dates in the data, top contacts by frequency, and a plain-language summary of what the data contains. Ideal for providing to clients or co-counsel.
Device Information
Phone make and model, operating system version, IMEI or serial number (when available), carrier, and last backup date. Establishes device identity for chain of custody purposes.
Chain of Custody
SHA-256 hash values for each uploaded evidence file, calculated before and after processing. Includes timestamp of examination, examiner certification, and hash verification status. This section is the foundation for admissibility arguments.
Key Evidence Summary
All items you flagged during Step 5, displayed in chronological order with your attorney notes. This section is designed to be detachable as a standalone exhibit summary.
SMS / Chat Messages
Full message threads rendered as chat bubbles, matching the visual appearance of the phone's native messaging app. Each message includes sender, timestamp, and delivery status. Supports SMS, iMessage, WhatsApp, and other platforms.
Call History
Complete call log with contact name (where available), phone number, call direction (inbound/outbound/missed), duration, and timestamp. Calls are color-coded by type for quick visual identification.
Photo Evidence
Thumbnail grid of all extracted photos with GPS coordinates (mapped to address where possible), EXIF metadata including capture date/time, camera settings, and device identifier. Photos flagged as key evidence appear at full size in the Key Evidence Summary.
Activity Timeline
A unified chronological event log combining messages, calls, and photos into a single timeline. Useful for establishing sequence of events and identifying gaps or patterns in communication.
Methodology
Describes the examination procedures used, file types accepted, data parsing approach, and the technical basis for evidence hashing. Includes an examiner certification block and a standard forensic disclaimer. This section directly addresses foundation challenges under FRE 901 and 902.