Digital Forensic Analysis of Criminal Evidence in Mobile Devices: A Literature Review

Abstract

Changing the way crime is investigated in the mobile era requires rigor and humanity: recovering the stories stored in phones without compromising their integrity. With that premise, this review sought to identify how effective and reliable current mobile forensic methodologies and tools are, and how they are being used in real investigative contexts. A structured systematic review was conducted using the PICO model, a Scopus search, and a PRISMA flowchart: from 229 records, 20 recent studies were screened and evaluated, examining research designs, methodological frameworks, extraction techniques, and performance by application and operating system. The results reveal an operational consensus: DFRWS and NIST frameworks guide the sequential phases of identification, preservation, acquisition, analysis, and reporting; commercial forensic suites (Cellebrite UFED, Magnet AXIOM, XRY, Oxygen, Belkasoft, MOBILedit) achieve high recovery rates, although with heterogeneous performance depending on the app, version, and encryption; and emerging automation approaches (ML/LLM and multimodal semantic analysis) accelerate triage and improve the correlation of textual, audio, image, and video evidence. Limitations persist, including modern encryption, cloud dependencies, uneven parsers, and explainability issues that affect legal admissibility. In conclusion, the evidence supports an integrated model—“standard framework + validated tool + explainable automation”—sustained by strict chain of custody and reproducible documentation. The review recommends open test datasets, cross-tool validation by case/OS/encryption level, and governance/ethical guidelines that balance investigative efficiency with privacy protection.