A standard methodology for examining information stored on mobile devices and their components

In brief

An announcement of the standard methodology for the forensic examination of information in mobile devices and their components (Investigative Committee of Russia, 2025); the printed version will come "at best" by the end of the year. The speaker explains why it was written from scratch (the FSKN's 2011 one marked FOUO, the EKC MVD's 2014 one and the 2023 revision) and what is new in it. The listener does not have the methodology itself — it is all by word of mouth.

Key points

• Sources are mandatory in the expert report — methodologies and methodological recommendations, not developers' "help files"; for computer information there are recommendations on Astra Linux, and ones on macOS are being written.
• The history (with a caveat about incomplete knowledge): the FSKN 2011 one marked FOUO → EKC MVD 2014 → a barely different 2023 revision → the Investigative Committee 2025.
• The object has been broadened from "mobile phones" to "mobile devices" — from keypad phones to smartwatches and smart bands; a description of encryption has been added.
• The equipment requirements are functional rather than by product name — "a road to nowhere"; the expert's hardware and software workstation must "have the ability" to remove and read memory chips, to block registration on the network, and to video-record.
• Fault diagnosis has grown from a tiny little table into an appendix with five types and the actions for each of them.
• If the password and the PIN/PUK have not been cracked — templates of motions: for the password, for the SIM card's PIN or PUK code, and for the user's presence for biometrics.
• Extraction is either low-level or of publicly accessible data; the stages: photographing the screen, a service mode, an agent program, downgrading the OS version, reading the SIM. The results may be written to SSDs and external HDDs: the signature on adhesive tape, and in the expert report the make, model, serial number, bytes and cryptographic hash.
• Clouds and email are the most problematic question (a meeting with the Forensic Science Centre of the Ministry of Internal Affairs (EKC MVD)): the speaker considers "got into the email account, downloaded all they needed" to be exceeding one's authority; the presence of tokens has become a stage of the examination — having found credentials for clouds, social networks and email, the expert notifies the investigator immediately.
• Errors in the investigator's questions: Federal Law 73-FZ is silent, the expert does not touch a methodologically wrong framing, and the rest "may be edited, indicating the reasons" — may, not must.
• Status: recommended by the Investigative Committee's Scientific and Technical Council to the Investigative Committee's units, and for everyone else it is "their right"; there is no printed version, the text is with the proofreader, and it will come out "at best" by the end of the year.

Tools, artifacts, technologies

• The methodology on mobile devices (Investigative Committee of Russia, 2025) — the subject of the talk; the methodology on computer information — the one in force; the predecessors — FSKN (2011, FOUO), EKC MVD (2014/2023).
• Vendors: ACE Lab, MKO Systems — must not be named in the methodology; Mobile Criminalist, Cellebrite — on procurement; MKO, Elcomsoft, ELETEK — from the question about the laboratory; "Special Equipment and Communications" — contracts for hardware-software systems.
• The expert's hardware and software workstation (see "Key points"), an ultrasonic bath and drying equipment; a hardware-software system for state secrets — a classified one; OneDrive, FISA / CLOUD — a "made-up case" from the audience.

Legal and organizational context

Federal Law 73-FZ (only the number appears in the transcript) does not regulate the editing of the investigator's questions; from the audience — under it the expert is liable for disclosure. Agencies: the Investigative Committee of Russia (GUK, SEC, the Scientific and Technical Council — reviews and recommends, does not develop), the EKC MVD of Russia, the FSKN, the FSB, the courts. State secrets: clearance for experts, a certified hardware-software system, FOUO material on a machine with internet access is a violation. Public procurement: functional requirements → technical specifications and contracts, and systems — through development (R&D) work.

Questions from the audience

1. Mikhail Mikhailovich (name by ear): why video recording? — It is a recommendation, more needed during inspections; the case of the swapped Samsung (whose is unclear).
2. The same person: why are there no smart TVs and set-top boxes? — The equipment was made, but "honestly, it's sitting on the desk"; they will write one if devices start being brought in constantly.
3. The same person: the expert is liable under Federal Law 73-FZ anyway, so why the restrictions on tokens? — The methodology only spells out the procedure; some MVD experts "turn a blind eye" and look into the clouds, and the department heads at the EKC MVD of Russia are against it.
4. From the audience, no name given: a made-up case — FOUO and state-secret material leaked abroad via OneDrive (FISA/CLOUD). — Nothing like that should be on a machine with internet access; inspecting a cloud is an investigative action, not a forensic examination.
5. "San Sanych" / Nikita (the attribution is not obvious): will there be a standard mobile laboratory "like those from MKO, Elcomsoft, ELETEK"? — The Scientific and Technical Council does not develop, it only recommends; the laboratory — through a state contract and development (R&D) work, and the vision of the equipment changes every six months.

The speaker's position

The methodology must be vendor-independent and reproducible; the speaker names neither equipment nor techniques. She acknowledges the limitations herself: some devices are "a brick", on state secrets "we have no other option", smart TVs are not covered. The tone is a lecture with self-irony ("bells and whistles", "little labels"), and she sells nothing.

Quotes

• "A methodology is a formalized algorithm of the expert's actions, ensuring the reproducibility and reliability of the results."
• "Have the ability to remove memory chips from mobile devices. Why, how, which product? I won't say…"
• "If they don't provide it, they don't — the expert often can't wriggle out of it…"
• "…that's one more way to show the judge that the investigator isn't very literate…"