--- title: "Mobile Device Forensics: Extraction, Decoding, and SQLite Database Analysis" date: 2026-02-02 canonical: "https://codeandcypher.com/papers/csol590-analyze-a-cell-phone-image/" author: "Joshua A. Wortz" institution: "University of San Diego" report_type: "Academic Research Paper / CSOL590" doi: "10.5281/zenodo.22287673" pdf_url: "https://codeandcypher.com/papers/csol590-analyze-a-cell-phone-image.pdf" description: "Digital forensics analysis of a mobile device image, decoding SQLite databases, call logs, and deleted communication artifacts." --- # Mobile Device Forensics: Extraction, Decoding, and SQLite Database Analysis **Author:** Joshua A. Wortz, MSCOL, CISSP ([ORCID: 0009-0003-6722-1019](https://orcid.org/0009-0003-6722-1019)) **Institution:** University of San Diego **Publication Date:** February 2, 2026 **DOI:** [10.5281/zenodo.22287673](https://doi.org/10.5281/zenodo.22287673) **PDF Download:** [Full Research Paper PDF](https://codeandcypher.com/papers/csol590-analyze-a-cell-phone-image.pdf) --- ## Abstract What is the phone number of this phone? The phone number is the same as the Mobile Subscriber Integrated Services Digital Network (MSISDN) number for the SIM card. --- ## Research Paper Body 2 Part I - Cellebrite reports and questions Review in Cellebrite Reader Figure 1 Downloaded and extracted the lab files locally. Figure 2 After opening CSOL590_iPhone.ufdr, adjust the time zone to match the device. Figure 3 Verified image Hash to ensure that the image is still unmodified. Preliminary Device Report Report generated, see the separate attached documentation. 1. What is the Message Retention Duration for this phone? Forever 2. What is the AppleID used on this phone? thisisdfir[@]gmail[.]com 3. What is the phone number of this phone? The phone number is the same as the Mobile Subscriber Integrated Services Digital Network (MSISDN) number for the SIM card. +19195794674 4. What is the name of the computer last used to back up this phone? Joshua’s Mac mini Analyzed Data Call Logs Figure 4 Outgoing phone call at 4/5/2020 4:42:18 PM(UTC-4) that was 23 seconds long. Maps Figure 5 Apple Maps entry on 4/5/2020 4:43:40 PM(UTC-4) at address Sweet Vista Ln, 152, Wake, Holly Springs, 27540, North Carolina, United States. Chats/Photos Figure 6 Skype message sent from Josh Hickman on 3/24/2020 9:16:14 AM(UTC-4) with a photo of a man wearing glasses holding a sign that says “Stop asking me to try YouTube Premium”. Activities Figure 7 On 4/5/2020, 8,403 steps were recorded via Fitbit. Passwords Figure 8 The Telegram user's account name is “This Is DFIR,” and the password is “1”. Export report Report generated, see separate attached document. Part II - Axiom reports and questions Call logs Figure 9 Call log on 4/5/2020 4:42:18 PM showing Partner Location is Fuquay-Varina, NC. Figure 10 Parked Car location on 4/5/2020 at 4:55:29 PM was shown to be at Lat 35.6594874386797 Longitude -78.872669079253. Figure 11 The Latitude and Longitude from the previous search show the car is parked at the corner of Sweet Vista Lane and Sweet Maple Court in Holly Springs, North Carolina. Chat Messages Figure 12 On 4/11/2020 at 9:35:07 PM, thisisdfir sent a message to hickdawg957 saying they had just realized Snapchat has location sharing. App Usage Figure 13 On 4/5/2020 4:31:16PM, the Apple Maps application was started. Export Report The report for all iOS iMessages/SMS/MMS is available in separately attached document. Part III - Brief analysis of Cellebrite vs. Axiom. In the field of digital forensics, academic literature distinguishes Cellebrite (Physical Analyzer/UFED) and Magnet AXIOM by their operational success rates and underlying investigative philosophies. Peer-reviewed research, such as a 2026 study published via ResearchGate, utilized the NIST Mobile Forensic Criteria to evaluate performance on modern, high-security devices like the Google Pixel 5a. The findings revealed that Cellebrite achieved a 75% success rate in artifact recovery, particularly excelling at extracting internet, geolocation, and social application data. In contrast, Magnet AXIOM recorded a 56% success rate. While it slightly outperformed Cellebrite in basic SMS recovery, it was notably less effective at decoding complex data from modern third-party applications (ResearchGate, 2026). Further academic analysis focuses on the "artifact-first" versus "low-level" forensic methodologies. Cellebrite is widely recognized for its technical depth in bypassing hardware- level encryption and performing Full File System (FFS) extractions, making it a critical tool for acquiring data from mobile devices (James, 2024). Conversely, Magnet AXIOM is a unified analysis platform that ingests and correlates data from mobile, computer, and cloud sources (Herald Scholarly Open Access, 2025). This holistic approach allows AXIOM to reconstruct user timelines across multiple platforms. However, researchers emphasize that, because both tools use different scanning algorithms and parsers, a dual-tool approach is essential to ensure evidentiary integrity and maximize artifact retrieval (Atlantis Press, 2025; ResearchGate, 2026). ### References Herald Scholarly Open Access. (2025). Digital forensics: Confronting modern cyber crimes, technological advancements, and future challenges. https://www.heraldopenaccess.us/openaccess/digital-forensics-confronting-modern- cyber-crimes-technological-advancements-and-future-challenges James, S. (2024). Foundations of mobile forensics: An academic approach. Issues in Information Systems, 25(3), 94-108. https://www.iacis.org/iis/2024/3_iis_2024_94-108.pdf Kumar, P., Rashid, E., & Narayan, R. (2025). A comparative study of mobile forensic tools for Android devices. Proceedings of the Recent Advances in Artificial Intelligence for Sustainable Development (RAISD 2025). Atlantis Press. https://www.atlantis-press.com/proceedings/raisd-25/126013758 ResearchGate. (2026, January 31). Comparative analysis of mobile forensic tools for digital evidence recovery using NIST framework. https://www.researchgate.net/publication/400268268_Comparative_analysis_of_mobile_ forensic_tools_for_digital_evidence_recovery_using_NIST_framework --- > **Archival Artifact:** The complete, formatted research publication can be accessed directly as a PDF at [https://codeandcypher.com/papers/csol590-analyze-a-cell-phone-image.pdf](https://codeandcypher.com/papers/csol590-analyze-a-cell-phone-image.pdf). --- ## Citation (APA 7th Edition) Wortz, J. A. (2026). *Mobile Device Forensics: Extraction, Decoding, and SQLite Database Analysis*. Code and Cypher. https://doi.org/10.5281/zenodo.22287673