Mobile device forensics expertise
Independent mobile forensic expertise for investigations, litigation, technical review, and training—grounded in process, validation, and deep analysis beyond automated tool output.
Services
From a single disputed artifact to a complete examination strategy, the work starts with the source data and follows the evidence—not assumptions made by a tool or report.
Technical examination and interpretation of mobile device data, application artifacts, databases, timestamps, location information, and related evidence.
A second look at collection methods, examiner conclusions, exported reports, unsupported artifacts, and the technical basis behind an opinion.
Clear technical guidance for investigators, legal teams, forensic practitioners, and organizations that need to understand mobile evidence and process.
The approach
Mobile forensic tools are powerful, but every tool has limits. Unsupported apps, source databases, time conversions, device behavior, and context can materially change what an artifact means.
“Interpret, validate, and understand the source.”
The goal is a defensible explanation of the evidence—where it came from, how it was interpreted, and what the data can and cannot establish.
Define what needs to be proven, disproven, validated, or better understood.
Work back from a report or artifact to the underlying file, database, metadata, or extraction.
Compare context, timestamps, tool behavior, and corroborating sources before drawing conclusions.
Translate technical findings into plain language without overstating what the evidence supports.
Lee Reiber
Lee Reiber is a pioneering mobile device forensic examiner, consultant, trainer, software-development innovator, and former law-enforcement officer with the Boise Police Department.
His work has focused on understanding mobile evidence beneath the automated report layer: data formats, file-system artifacts, application data, time interpretation, evidence handling, and the repeatable processes needed to support defensible findings.
Published expertise
Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation, Second Edition covers evidence handling, acquisition, analysis, application data, SQLite, cloud and connected-device evidence, and reporting.
View the book at McGraw HillForensic software
CPD Forensics software extends the same evidence-first approach into focused technical workflows—preserving source identity, exposing the analysis path, and producing records that can be reviewed and explained.
QR code digital forensics
Decode and preserve QR evidence, inspect redirect chains and destinations, surface risk indicators, and create a structured technical record.
AI media screening & analysis
Screen images and videos for possible synthetic or manipulated media while preserving source identity, reviewable analysis signals, and result history.
Product 01 · QRensic
QRensic turns a QR image into an auditable technical record—helping investigators move from a decoded payload to destination analysis, risk indicators, preserved evidence, and reporting in one desktop workflow.
QR CODE DIGITAL FORENSICS
Instead of treating a QR code as a simple link, QRensic documents the technical path behind it. The workflow is designed to preserve what was scanned, inspect where it leads, identify suspicious behavior, and make the analysis easier to document.
Hash the source image and retain decoded payloads, timestamps, and analysis identifiers.
Inspect redirect chains, final destinations, DNS resolution, TLS certificates, and page behavior.
Surface phishing, credential-harvesting, suspicious redirects, and threat indicators.
Create structured evidence records, with professional PDF reporting available in the Professional workflow.
Product 02 · DeepFakeGuard
DeepFakeGuard uses the DeepFakeGuard Fusion engine to analyze images and videos while preserving source-file identity, exposing reviewable media signals, and retaining analysis history for investigation and reporting.
AI MEDIA SCREENING & ANALYSIS
DeepFakeGuard is designed for investigators and professionals who need more than a single unexplained score. It keeps the source file tied to the analysis, documents the screening record, and makes the underlying signals easier to inspect and explain.
Hash the source media and retain technical metadata that ties each result to the exact file analyzed.
Run the DeepFakeGuard Fusion engine across image or video evidence and preserve the analysis context with the result.
Review classifications and video-level or frame-level signals instead of relying on a single opaque result.
Keep a searchable analysis history and, with Pro, export a professional AI Media Analysis Report from stored scan results.
DeepFakeGuard provides probabilistic AI-media screening signals, not proof that media is authentic or manipulated. Results should be interpreted with the source evidence and investigative context.
DeepFakeGuard · Fusion
DeepFakeGuard Fusion · investigator-oriented media screening workflow
The Mobile Device Examiner
A framework for identifying weak links across the mobile forensic examination process.
Read insights ↗Why unsupported applications demand source-level analysis instead of blind reliance on automation.
Read article ↗How location artifacts and timelines can add context and corroboration to an investigation.
Read article ↗Start a conversation
Share the basic case context and what you need evaluated. Sensitive evidence should only be transferred through an agreed secure method.