Connected Phone Forensics

Find every phone that was connected to a computer, what it left there, and exactly where each fact came from.

USB · Bluetooth · Wi-Fi hotspots · Phone Link · iPhone pairing and backups · Messages · AirDrop · KDE Connect
from Windows, macOS and Linux disk images, triage collections, or the running computer itself.

   

Why

Seized phones are increasingly unreadable: since iOS 18.1 a locked iPhone reboots into Before-First-Unlock after 72 hours without use, and full-file-system extractions depend on exploits that come and go. The suspect's computer is usually easier to examine, and phones leave a trail on every computer they touch: pairing records, backups, USB and Bluetooth history, hotspot connections, companion apps, synced messages and calls.

Connected Phone Forensics finds that trail and answers three questions:

• Which phones touched this computer? Each phone is identified by its UDID, serial, IMEI, Bluetooth or Wi-Fi MAC, or USB serial, every identifier is decoded (an iPhone UDID names its chip and model family, an IMEI its model code, a MAC address its maker) and traced to the record that holds it.
• When, and over which connection? USB, Bluetooth, hotspot, pairing, backup, Phone Link, Continuity, companion apps, with first and last seen for each.
• What phone data is on the computer? Messages, calls, contacts, photos, notifications and apps, each tagged with the phone it came from, including records recovered after deletion.

Highlights

• 23 parsers for Windows, macOS and Linux, run in parallel. Point it at a mounted image or a KAPE, Velociraptor or UAC collection and every computer inside is found automatically.
• Live acquisition of the running Windows computer, for examining a computer on site: locked registry hives are saved through the registry API, protected files are read with the backup privilege, everything is hashed and logged, and the output goes to a USB drive, never to the drive being examined. A portable build runs from the USB drive without unpacking anything onto it.
• Recovered data at a glance: messages, calls, contacts with their photos, photos and files, notifications and apps with their icons, per phone; deleted and present records told apart. Search, filter any column as in Excel (contains, does not contain, a regular expression, dates, numbers, a checklist of values), and export to Excel or CSV.
• Save the files themselves, verified: the selected items, the current view, a whole kind or everything, copied byte for byte into a new folder, each copy hashed and checked against the hash taken at the scan, marked read-only and given its record's time, with a manifest and a SHA256SUMS.txt.
• Phones named the way people know them: "OnePlus 12R (CPH2585)", not a model code or a UUID, from Google Play's device list, USB vendor IDs, and the names people give their phones and hotspots.
• Hotspots grouped by network: a phone known only by its Wi-Fi hotspot is one network with a row per access point (phones use a new random address each time), and an optional, logged lookup of where an access point was seen.
• Three reports from every scan: a detailed, auditable HTML report; a clean PDF summary to draft a forensic report from; and an Excel workbook with a summary sheet and one sheet per phone.
• One device per phone, defensibly. Records merge only through strong identifiers named together in one record, and each merge shows the record that caused it. Shared names, numbers and neighbouring MAC addresses are shown as possible matches and never merged silently.
• Provenance for every fact: source file, SHA-256 and a locator precise enough to find the record by hand (SYSTEM:\ControlSet001\Enum\USB\...\0066, table=message rowid=42).
• Read-only and verifiable. Databases and hives are read from copies, every evidence file read is hashed into a manifest, and nothing is skipped silently: unknown formats are reported.
• A guide built in: what each connection leaves on a computer, what can be recovered and when it cannot, how to read the results, and the tool's limits.

Screenshots

Overview: the case at a glance, with its reports	Recovered data: filter any column, as in Excel
New scan: a folder, or this computer live	Hotspots: one network, a row per random access point
Devices: the phone drawn with its recovered wallpaper	Contacts with their photos, in the light theme
Guide: how it works, what is recovered and when not, limits	Live acquisition: examine the running computer, output to a USB drive
Photos and files, saved as verified copies	Timeline: every record with its file, locator and SHA-256
PDF summary: the case at a glance, then a page per phone

_{Screenshots show the built-in demo case: entirely synthetic data.}

Quick start

Windows: download and run

From the latest release:

The executables are not code-signed yet, so SmartScreen may say Windows protected your PC: choose More info → Run anyway. Check the download against SHA256SUMS.txt first:

certutil -hashfile ConnectedPhoneForensics-0.3.1-windows-x64.exe SHA256

Then click Run the demo case to see it work on synthetic data, or drop an evidence folder on New scan.

Install with pip (Windows, macOS, Linux)

pip install connected-phone-forensics

Then run cpf-gui for the desktop app or cpf --help for the command line. Needs Python 3.10 or newer.

Try it without evidence

cpf demo ./demo

builds a synthetic case (a Windows laptop, a MacBook and a Linux desktop that one iPhone and one Pixel touched), scans it and writes the reports to ./demo/report. Every byte is generated.

Usage

Desktop app

Open results folder reopens any earlier scan. Keyboard: Ctrl+N new scan, Ctrl+O open results, Ctrl+F search, Ctrl+1…8 switch pages, F1 the guide.

Command line

cpf scan /mnt/evidence -o ACME-case --case ACME-Incident-EmpID39323 --examiner "A. Examiner"

Live forensics

For examining a computer where it stands, for example during a search, when the question is which phones were connected to it and what they left:

1. Unzip …-portable.zip onto a USB drive (or an external disk). The portable folder runs in place, so the program is not unpacked onto the computer's own drive, and it keeps its settings next to itself instead of in the computer's registry.

2. On the computer, run ConnectedPhoneForensics.exe and choose New scan → This computer (live). The app shows the computer, its Windows version and user profiles, and whether it runs as administrator; Restart as administrator asks Windows for the rights it needs.

3. Choose the output drive: the USB drive is suggested. The drive being examined is refused, because writing there overwrites free space that may still hold deleted evidence (it can be allowed explicitly; the report then records it).

4. Start live acquisition. Or from an administrator terminal:

   E:\ConnectedPhoneForensics\cpf.exe live -o E:\cases\ACME-Incident-EmpID39323 --case ACME-Incident-EmpID39323 --examiner "A. Examiner"
   

What happens:

• The registry hives Windows keeps locked (SYSTEM, SOFTWARE and the NTUSER.DAT of every signed-in user) are saved through the registry API, RegSaveKeyEx, as reg save does: a consistent copy of each hive as Windows sees it at that moment.
• Every other file the parsers read is copied with the backup privilege, so folder permissions cannot hide it, with its SQLite and registry journal files. Each file is hashed while it is read, and the copies keep the original creation, access and modification times (parsers use them).
• The copy (collection/) is then scanned like any triage collection, and the reports are written to report/. acquisition.json and acquisition.sha256 list every item with its source, method and SHA-256; acquisition.log has the timestamped steps.
• Any program run on a computer leaves traces of its own: Windows records a Prefetch entry for the program and event-log entries for the administrator prompt. They do not affect the files acquired; mention them in your notes.

Reports

Every scan writes three reports from the same records:

What it finds

Validation levels are printed in every report. synthetic: tested against fixtures built from public documentation. public_sample: also tested against real public data (the DFIR Artifact Museum). ground_truth: tested against data created on real devices with recorded actions. See docs/VALIDATION.md; ground-truth datasets are the most valuable contribution the project can receive.

How it works

More in docs/ARCHITECTURE.md.

How evidence is treated

• Read-only. SQLite databases are copied together with their -wal and -shm files and the copy is opened, so the original is never modified and committed WAL records are not lost. Dirty registry hives are recovered from their transaction logs on a copy, following the REGF specification: only entries that continue the hive's sequence and pass their hash checks are applied, and logs next to a clean hive are left alone.
• Hashed. Every evidence file read is SHA-256 hashed; hashes, tool version and command line go into manifest.json.
• Nothing skipped silently. Every file a parser opened is in the coverage table. A file whose format is not recognised is reported as unrecognised, not dropped, and a folder that cannot be read is reported as an error.
• Honest time. All times are UTC. Local-time artifacts are converted with the time zone recorded in the same image. Filesystem times are labelled as such and do not set a phone's first or last seen.
• Long paths. On Windows, evidence deeper than 260 characters (common for Phone Link) is read with extended-length paths, so it is never mistaken for missing.

Outputs

Possible matches and examiner conclusions

Weak clues (the same device name, a phone number, MAC addresses that differ by one, a hotspot BSSID derived from the phone's address) never merge records automatically. They are listed per pair of devices with the number of independent signals. When an examiner has verified that two identifiers belong to one phone, the conclusion can be recorded, and it is labelled as an examiner assertion in the report and manifest:

cpf scan /mnt/evidence -o out --assume-same udid=00008120001A2B3C4D5E801E,bt_mac=a4:c3:37:5e:10:2b

Collecting only what it needs

cpf targets --format kape > CPF.tkape
cpf targets --format velociraptor > CPF.yaml
cpf targets --format list

The targets are generated from the parsers' own path declarations, so a collection always matches what the installed version can parse.

Project status

Early release (0.3). The tool runs end to end on Windows, macOS and Linux, and every parser has automated tests, but only three parsers have been checked against real public data and none yet against ground-truth data from real phones. A code review in October 2026 found issues that are not all fixed yet. Its one critical finding, recovery of deleted SQLite rows (Phone Link, Windows notifications) reporting rows from another table as recovered messages or notifications, was fixed in 0.1.2: a row is now attributed to a table only when its page belonged to that table in the database state it was read from. The open issues are listed in the changelog.

Treat results as leads and verify them against the source records the report points to, which is good practice with any forensic tool.

Roadmap

• Fix the open review findings
• Ground-truth validation with real iPhone and Android devices
• Code-signed Windows builds
• Recording examiner conclusions (same phone / not the same phone) from the desktop app

Building from source

git clone https://github.com/sujayadkesar/connected-phone-forensics
cd connected-phone-forensics
python -m venv .venv && . .venv/bin/activate      # Windows: .venv\Scripts\activate
pip install -e ".[dev]"
python -m pytest                                  # GUI tests run headless
python -m ruff check connected_phone_forensics tests

Windows executables: pip install -e ".[build]", then python packaging/build.py and python packaging/smoke_test.py dist. Releases are built the same way by GitHub Actions when a version tag is pushed.

Contributing

Parsers are small, self-registering modules. CONTRIBUTING.md describes the plugin API and the evidence-handling rules every parser follows. Bug reports, artifact requests and ground-truth datasets are welcome in the issue tracker. Please report security problems privately, as described in SECURITY.md.

Citing

If you use Connected Phone Forensics in research or casework documentation, please cite it; GitHub shows a citation from CITATION.cff under Cite this repository.

License

See LICENSE; the components it builds on are listed in THIRD-PARTY-NOTICES.md. Provided as is, without warranty: validate results before relying on them in legal proceedings.