Connected Phone Forensics

Find every phone that was connected to a computer, and show exactly where each fact came from.

USB · Bluetooth · Wi-Fi hotspots · Phone Link · iPhone pairing and backups · Messages · AirDrop · KDE Connect
from Windows, macOS and Linux disk images and triage collections.

   

Why

Seized phones are increasingly unreadable: since iOS 18.1 a locked iPhone reboots into Before-First-Unlock after 72 hours without use, and full-file-system extractions depend on exploits that come and go. The suspect's computer is usually easier to examine, and phones leave a trail on every computer they touch: pairing records, backups, USB and Bluetooth history, hotspot connections, companion apps, synced messages and calls.

Connected Phone Forensics finds that trail and answers three questions:

• Which phones touched this computer? Each phone is identified by its UDID, serial, IMEI, Bluetooth or Wi-Fi MAC, or USB serial, and every identifier is traced to the record that holds it.
• When, and over which connection? USB, Bluetooth, hotspot, pairing, backup, Phone Link, Continuity, companion apps, with first and last seen for each.
• What phone data is on the computer? Messages, calls, contacts and notifications, each tagged with the phone it came from.

Highlights

• 23 parsers for Windows, macOS and Linux, run in parallel. Point it at a mounted image or a KAPE, Velociraptor or UAC collection and every computer inside is found automatically.
• One device per phone, defensibly. Records merge only through strong identifiers named together in one record, and each merge shows the record that caused it. Shared names, numbers and neighbouring MAC addresses are shown as possible matches and never merged silently.
• Provenance for every fact: source file, SHA-256 and a locator precise enough to find the record by hand (SYSTEM:\ControlSet001\Enum\USB\...\0066, table=message rowid=42).
• Read-only and verifiable. Databases and hives are read from copies, every evidence file read is hashed into a manifest, and nothing is skipped silently: unknown formats are reported.
• Desktop app and command line. A fast native app for examination, and a CLI for scripting and pipelines. Both write the same report, Timesketch timeline and JSON.

Screenshots

New scan: drop the evidence; the computers inside are listed before you start	Live progress: parsers run in parallel and can be cancelled
Devices: identifiers, connections, why records were linked	Timeline: every record with its file, locator and SHA-256
Coverage: every file a parser read, and what came of it	Light theme

_{Screenshots show the built-in demo case: entirely synthetic data.}

Quick start

Windows: download and run

1. Download ConnectedPhoneForensics-<version>-windows-x64.exe from the latest release. Nothing to install.
2. Run it. The executable is not code-signed yet, so SmartScreen may say Windows protected your PC: choose More info → Run anyway. Check the download against SHA256SUMS.txt first:

   certutil -hashfile ConnectedPhoneForensics-0.1.0-windows-x64.exe SHA256
   

3. Click Run the demo case to see it work on synthetic data, or drop your evidence folder on New scan.

The same release has cpf-<version>-windows-x64.exe, the command-line tool.

Install with pip (Windows, macOS, Linux)

pip install connected-phone-forensics

Then run cpf-gui for the desktop app or cpf --help for the command line. Needs Python 3.10 or newer.

Try it without evidence

cpf demo ./demo

builds a synthetic case (a Windows laptop, a MacBook and a Linux desktop that one iPhone and one Pixel touched), scans it and writes the report to ./demo/report. Every byte is generated.

Usage

Desktop app

Open results folder reopens any earlier scan. Keyboard: Ctrl+N new scan, Ctrl+O open results, Ctrl+F search, Ctrl+1…6 switch pages.

Command line

cpf scan /mnt/evidence -o case42 --case 42 --examiner "A. Examiner"

What it finds

Validation levels are printed in every report. synthetic: tested against fixtures built from public documentation. public_sample: also tested against real public data (the DFIR Artifact Museum). ground_truth: tested against data created on real devices with recorded actions. See docs/VALIDATION.md; ground-truth datasets are the most valuable contribution the project can receive.

How it works

flowchart LR
    A[Evidence folder<br>image or collection] --> B[Find each<br>Windows / macOS / Linux root]
    B --> C[23 parsers<br>in parallel]
    C --> D[Records with provenance<br>file, locator, SHA-256]
    D --> E[Correlate<br>strong identifiers only]
    E --> F[Device graph<br>+ possible matches]
    F --> G[Report, timeline,<br>JSON, manifest]

More in docs/ARCHITECTURE.md.

How evidence is treated

• Read-only. SQLite databases are copied together with their -wal and -shm files and the copy is opened, so the original is never modified and committed WAL records are not lost. Dirty registry hives are recovered from their transaction logs on a copy, following the REGF specification: only entries that continue the hive's sequence and pass their hash checks are applied, and logs next to a clean hive are left alone.
• Hashed. Every evidence file read is SHA-256 hashed; hashes, tool version and command line go into manifest.json.
• Nothing skipped silently. Every file a parser opened is in the coverage table. A file whose format is not recognised is reported as unrecognised, not dropped, and a folder that cannot be read (for example the locked registry folder on a live system) is reported as an error.
• Honest time. All times are UTC. Local-time artifacts are converted with the time zone recorded in the same image. Filesystem times are labelled as such and do not set a phone's first or last seen.
• Long paths. On Windows, evidence deeper than 260 characters (common for Phone Link) is read with extended-length paths, so it is never mistaken for missing.

Outputs

Possible matches and examiner conclusions

Weak clues (the same device name, a phone number, MAC addresses that differ by one, a hotspot BSSID derived from the phone's address) never merge records automatically. They are listed per pair of devices with the number of independent signals. When an examiner has verified that two identifiers belong to one phone, the conclusion can be recorded, and it is labelled as an examiner assertion in the report and manifest:

cpf scan /mnt/evidence -o out --assume-same udid=00008120001A2B3C4D5E801E,bt_mac=a4:c3:37:5e:10:2b

Collecting only what it needs

cpf targets --format kape > CPF.tkape
cpf targets --format velociraptor > CPF.yaml
cpf targets --format list

The targets are generated from the parsers' own path declarations, so a collection always matches what the installed version can parse.

Project status

Early release (0.1). The tool runs end to end on Windows, macOS and Linux, and every parser has automated tests, but only three parsers have been checked against real public data and none yet against ground-truth data from real phones. A code review in October 2026 found issues that are not all fixed yet. Its one critical finding, recovery of deleted SQLite rows (Phone Link, Windows notifications) reporting rows from another table as recovered messages or notifications, was fixed in 0.1.2: a row is now attributed to a table only when its page belonged to that table in the database state it was read from. The open issues are listed in the changelog.

Treat results as leads and verify them against the source records the report points to, which is good practice with any forensic tool.

Roadmap

• Fix the open review findings
• Ground-truth validation with real iPhone and Android devices
• Code-signed Windows builds
• Recording examiner conclusions (same phone / not the same phone) from the desktop app

Building from source

git clone https://github.com/sujayadkesar/connected-phone-forensics
cd connected-phone-forensics
python -m venv .venv && . .venv/bin/activate      # Windows: .venv\Scripts\activate
pip install -e ".[dev]"
python -m pytest                                  # GUI tests run headless
python -m ruff check connected_phone_forensics tests

Windows executables: pip install -e ".[build]", then python packaging/build.py and python packaging/smoke_test.py dist. Releases are built the same way by GitHub Actions when a version tag is pushed.

Contributing

Parsers are small, self-registering modules. CONTRIBUTING.md describes the plugin API and the evidence-handling rules every parser follows. Bug reports, artifact requests and ground-truth datasets are welcome in the issue tracker. Please report security problems privately, as described in SECURITY.md.

Citing

If you use Connected Phone Forensics in research or casework documentation, please cite it; GitHub shows a citation from CITATION.cff under Cite this repository.

License

MIT. Provided as is, without warranty: validate results before relying on them in legal proceedings.