Macro photograph of a disassembled mobile device logic board
[ SECTION_00 // WHAT WE CAN RECOVER ]

DEADBOX

FORENSICS// MOBILE_DATA_AUTOPSY

We read phones. Contacts, messages, photos, app data, and in a lot of cases the things someone deleted. We run two benches. One reads current hardware. The other reads phones too old for most labs to touch. Send the model number first. We tell you what we can recover before you pay.

BENCHES
02
DEPTH TIERS
06
DEVICE TYPES
05
STATUS
ONLINE
SCROLL_TO_CONTINUE // DECRYPTION_IN_PROGRESS▼
[ SECTION_01 // DEVICE_SUPPORT ]

WHAT WE CAN RECOVER

Six tiers. The first five say how deep we read. The sixth is separate. It decides whether we can get into a locked phone at all.

0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[DP-01]TIER

LOGICAL

Contacts, calls, texts, calendar. Whatever the phone hands over through its own menus. Fast. Nothing deleted.

  • › LIVE RECORDS
  • › FASTEST PASS
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[DP-02]TIER

ADVANCED LOGICAL

The above, plus the phone's own backup. Picks up app data the basic pass misses. Current iPhones and Android flagships land here.

  • › BACKUP CHANNEL
  • › APP DATABASES
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[DP-03]TIER

FILE SYSTEM

App databases, caches, settings. Deleted messages often survive here, because apps mark a record gone without wiping it.

  • › SQLITE FREE PAGES
  • › SOME DELETED DATA
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[DP-04]TIER

FULL FILE SYSTEM

The whole file system, decrypted. The deepest read we offer. Reaches saved passwords, system logs, and app data that no backup holds.

  • › DECRYPTED
  • › KEYCHAIN + LOGS
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[DP-05]TIER

PHYSICAL

A straight copy of the memory chip, empty space included. Best odds on deleted files. Limited to certain chips.

  • › BIT FOR BIT
  • › UNALLOCATED SPACE
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[DP-06]TIER

LOCK ACCESS

Getting past a passcode. Depends on the chip, the security patch date, and how the phone encrypts itself. Quoted per phone.

  • › PASSCODE RECOVERY
  • › QUOTED PER DEVICE
[ PLATFORM_COVERAGE ]
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[PL-01]PLATFORM

APPLE / iOS

Age helps. Older chips have known weaknesses, so a 2016 iPhone 7 gives up more than a 2023 iPhone 15. We go by the chip, not the model year.

  • › A7 TO A11 // FULL FILE SYSTEM
  • › A12 TO A17 // ADVANCED LOGICAL
  • › iOS 12.3 THROUGH 17
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[PL-02]PLATFORM

ANDROID

The chip matters, not the brand. A Galaxy sold in Europe runs an Exynos chip. The same Galaxy sold here runs a Qualcomm one. They need different methods.

  • › EXYNOS / SNAPDRAGON
  • › MEDIATEK / UNISOC / KIRIN
  • › ANDROID 4 THROUGH 14
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[PL-03]PLATFORM

LEGACY BENCH

Our second bench runs 2018 software on purpose. Extraction tools drop old phone profiles as they add new ones, so a lab running only the current version hands the phone back. We kept the old version.

  • › FLIP + FEATURE PHONES
  • › CDMA / WINDOWS PHONE
  • › PRE-2018 ANDROID
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
0x4A2F READ SECTOR 0x0001
0x8B1C PARSE FAT TABLE
0xFF0A DECRYPT BLOCK 0x4A
0x771E HASH VERIFY SHA-256
0x2D90 EXTRACT SMS.DB
0xC3A1 MOUNT UFS PARTITION
0x1F44 ACQUIRE CHAT CACHE
0x9E02 RECONSTRUCT INDEX
[PL-04]PLATFORM

OTHER DEVICES

Phones are most of the work. They are not all of it. Memory cards carry no lock, which usually makes them the fastest jobs on the bench.

  • › SIM EXTRACT + CLONE
  • › SD / USB / MODEMS
  • › DRONE FLIGHT LOGS
[ CONFIRMED_MODELS // FULL FILE SYSTEM ]
  • APPLEiPhone 5s through iPhone X read at full file system. iPhone XS through iPhone 15 read at advanced logical.
  • GOOGLEEvery Pixel up to the Pixel 7 line, including Pixel 7, 7 Pro, 7a, Pixel Tablet and Pixel Fold.
  • SAMSUNGGalaxy S23 FE, S22 Ultra (Exynos), A05, A12, A15, A21, A25. Galaxy Tab A9, A9+, S9, S9+, S9 Ultra, S9 FE, S9 FE+.
  • MOTOROLAMoto G14, G34, G54, G84, Moto G Pure, Moto G Play.
  • XIAOMIRedmi 9, 9A, 9C, Redmi A2, A2+, Redmi K50, Redmi Note 11T Pro+, Poco C51.
  • OPPO / VIVOOppo A15, Oppo Reno8 Pro+ 5G, Vivo S15.
THIS LIST IS NOT EXHAUSTIVE

We support tens of thousands of models. This page names a few dozen, picked to show how current we are. Your phone missing from the list tells you nothing either way. Send the model number and we will tell you what we can recover, free, before you ship.

[ SECTION_02 // PROCESS_TIMELINE ]

CHAIN_OF_CUSTODY

  1. REF_INTAKE // EVIDENCE_SEAL
    01

    INTAKE & SEAL

    Your device is photographed and sealed in tamper-evident packaging the day it lands. Timestamp, case ID and a handler signature go on every item.

  2. REF_ACQ // READ_ONLY
    02

    ACQUISITION

    We take the lightest read that answers your question, then go deeper if the case needs it. The source device is never written to.

  3. REF_DECRYPT // ARTIFACT_REBUILD
    03

    DECRYPTION & PARSE

    Encrypted partitions and app databases get decoded. Deleted records are rebuilt from free space, where they survived long enough to find.

  4. REF_ANALYSIS // TIMELINE_BUILD
    04

    ANALYSIS

    Timeline, keyword index, and the links between messages, media, location and account data. You get a picture of what happened, not a pile of files.

  5. REF_REPORT // COURT_READY
    05

    FINAL REPORT

    A report you can hand to a court. Hash verification, our methods written out, examiner credentials, and custody documented end to end.

DEADBOX/FORENSICS

We read phones, tablets, SIM cards, memory cards and drones, and we write down every step so the result holds up later. Two benches: one for current hardware, one for phones nobody else still supports.

[ BEFORE YOU SHIP ]
  • Do not power it on.
  • Do not charge it.
  • Do not guess at the passcode.

Failed attempts trip wipe counters and change the encryption state. That closes doors that were open when you found it.

© 2026 DEADBOX FORENSICS // ALL_RIGHTS_RESERVED
SYSTEM_STATUS: OPERATIONAL █