By Joshua J. Horowitz · Updated October 2026
Our phones hold an extraordinary record of our lives: who we know, what we say, and where we have been. In criminal prosecutions and civil disputes alike, that data is often at the center of the evidence. But phone evidence is only as reliable as the process used to extract it and the expertise of the person interpreting it. That is where cross-examination begins.
How phone evidence reaches the courtroom
Law enforcement typically extracts a phone's contents with tools such as GrayKey or Cellebrite, then analyzes the extraction with forensic software that produces a report of messages, call logs, photos, location data, and much more. Modern extractions can also surface data from places most users never see, such as system databases that record notifications and device activity. Every step in that process involves tools, choices, and assumptions, and each one can be examined in front of the jury.
Start with the basics: time
Many cases, conspiracy cases in particular, turn on who said what to whom, and when. Timestamps feel objective, but they come from somewhere, and the expert should be able to say exactly where. Device clock settings, time zones, and the difference between when a message was sent, received, or merely recorded by the phone can all matter. A few precise questions can show the jury that the timing is less certain than it appears:
Q. I just want to ask you a few questions about the time stamps that you testified about on direct. You said that if you look in the top left-hand corner, that time corresponds to the time that the message was received by that phone, right?
A. I'm sorry, which time are you referring to?
Q. Where it says Sunday, December 16, 2012?
A. Yes.
Q. Those time stamps on the text messages that you testified about, they are obtained from the phone's internal clock, right?
A. That's correct.
Q. The time that the phone is set to can be altered in the phone's settings, right?
A. It depends on the device. Usually the time is retrieved from whatever network it is connected to.
Q. But for this specific phone, you don't know whether that is the case, right?
A. Not off the top of my memory.
Q. It is possible then that the dates and times that are reflected here do not accurately represent the time that those messages were sent or received by the phone, right?
A. It is possible.
MR. HOROWITZ: Thank you. Nothing further, your Honor.
Then examine the process
Sound forensic practice requires isolating a phone from cellular and Wi-Fi networks before examining it, so the phone cannot send or receive data and its contents cannot change. Whether that happened is usually documented, or conspicuously missing, in the examiner's worksheets and notes, which should be requested and reviewed carefully before trial:
Q. I want to start by asking you a few questions about sound forensic practice when you're conducting a cell phone examination.
A. Sure.
Q. Now, you testified on your direct that you have had about 60 hours of classroom training in conducting cell phone forensics, right?
A. Yes, sir. That's right.
Q. In that training, you're taught that one of the first things that you do when examining a cell phone is that you should isolate it from cell tower signals and Wi-Fi signals, right?
A. That's right.
Q. One of the most common ways to accomplish that is to put the phone into what is called airplane mode, right?
A. That's right.
Q. What that essentially does is it disconnects the phone from any outside cell towers or Wi-Fi signals, Bluetooth connections, that kind of thing?
A. Right.
Q. The reason that you do that is because it ensures that the phone isn't going to be sending or receiving any data at the time that you're conducting the examination, right?
A. That's correct.
Q. And that the information in the phone won't be altered in any way?
A. That's correct.
Q. In fact, you have testified in the past about the importance of this practice, right?
A. I specifically haven't testified about that practice, but other forensic examiners have.
Q. When you examined the phone ending in 2656, you didn't do that, right?
A. I don't recall doing that.
Q. If you look in the top left corner of the screen, you can see that the phone has obtained a cell phone signal while you were conducting the examination, right?
A. It appears to have connected to a network.
Q. So you didn't follow that practice, right?
A. Possibly not for this phone.
The bottom line
The right cross-examination depends on the case, the defense theory, and how much the phone evidence matters. But the examiner's knowledge, tools, and procedures are almost always a productive place to start, to test the integrity of the results and the conclusions drawn from them. As extraction tools grow more powerful and less transparent, whether the witness truly understands the data has only become more important.
The excerpts above are from the cross-examination of government cell phone forensics experts in a narcotics conspiracy trial in the Southern District of New York. The jury deadlocked, 8 to 4 in favor of acquittal, and a mistrial was declared. This article is for general information and is not legal advice.