Description

Cell Phone Investigation Kit

Multi-Platform Mobile Device Investigation & Data Extraction

The Cell Phone Investigation Kit (CPIK) is a portable mobile investigation toolkit combining dedicated iPhone/iPad, Android and SIM-card investigation tools for structured access, extraction, review and export of mobile-device data.

Instead of relying on one generic extraction application, CPIK separates the workflow into platform-specific tools:

iPhone/iPad → iRecovery Stick
Android → Phone Recovery Stick
SIM/UICC → SIM Card Seizure

This makes CPIK particularly relevant to investigators working across mixed mobile-device environments where the evidence source may change from case to case. PBN-TEC describes the kit as supporting iPhone, iPad, Android phones/tablets and SIM-card examination, with a 64GB USB drive, connectivity cables, SIM adapter and protective case included.

The Mobile Evidence Problem

Modern investigations rarely involve only one type of mobile device.

A case may involve:

• An iPhone or iPad
• An Android smartphone
• An Android tablet
• A SIM/UICC card
• Multiple devices from different manufacturers
• Communications records
• Contacts
• Call records
• Photos and videos
• Web activity
• Application-related data
• Location-related artifacts
• Data requiring structured review and export

CPIK addresses this mixed-device environment by combining separate investigation utilities into one portable kit rather than requiring investigators to purchase each component independently.

Platform-Specific Investigation Architecture

iPhone & iPad Investigation

The included iRecovery Stick provides the iOS/iPadOS-focused component of CPIK.

Its role is to extract and investigate supported data from compatible iPhone, iPad and iPod touch devices. The current CPIK documentation specifies iOS 16.x and below for the included iRecovery component, so compatibility should be verified against the actual device and software version before acquisition.

Potential data categories described across PBN-TEC’s current iRecovery material include:

• Messages
• Call logs
• Contacts
• Web history
• Calendar information
• Photos
• Voice memos
• Email-related information
• Map/location history
• Other supported device artifacts

The actual dataset depends on device model, operating-system version, access conditions and what the extraction tool can access.

Android Investigation

The included Phone Recovery Stick provides the Android investigation component.

PBN-TEC describes it as a tool for structured access and artifact discovery on Android smartphones and tablets. Current material identifies data categories including:

• SMS
• Call logs
• Contacts
• Photos and videos
• Web history
• Voice memos
• Supported application data
• Hidden media associated with supported photo-hiding applications
• Timeline and metadata information
• Keyword-based artifact searching
• Bookmarking and export

The manufacturer states that most onboard user data can be accessed without rooting, while deleted-data recovery may require additional device-level conditions. This should therefore not be interpreted as guaranteed deleted-data recovery across Android devices.

SIM / UICC Investigation

The included SIM Card Seizure provides a dedicated SIM-level investigation layer.

It can examine SIM-resident information such as:

• Contacts
• SMS messages
• Call-related records
• Last-dialed information
• Deleted records that remain resident on the SIM

A critical limitation is that modern smartphones often store messages internally rather than on the SIM. Therefore, SIM examination is a separate evidence source, not a substitute for handset acquisition.

Mobile Artifact Discovery

CPIK is most useful when the objective is not simply to “copy a phone,” but to identify and review specific categories of digital artifacts.

Depending on the platform and supported tool, investigators can work with:

Communication Artifacts

• SMS
• Call records
• Contacts
• Supported application communications

Multimedia Artifacts

• Photographs
• Videos
• Voice recordings
• Other supported media

Activity Artifacts

• Web history
• Timestamps
• Metadata
• Location-related information
• Application-related activity

Investigation Artifacts

• Keyword matches
• Bookmarked items
• Exported case information
• Structured reports

Authorized Mobile Data Access

CPIK should be used only where investigators have lawful authority and the necessary access to the device.

PBN-TEC’s current Android documentation explicitly frames the workflow around lawful access and valid device credentials. The kit should therefore be positioned as a controlled mobile investigation solution, not a bypass system.

Data Review & Case Preparation

The investigation workflow does not end with extraction.

CPIK’s tools allow investigators to:

• Review extracted datasets
• Search for relevant information
• Bookmark significant artifacts
• Export selected information
• Save extracted data to removable storage
• Prepare information for subsequent case-file or analytical workflows

The included 64GB USB drive is intended to provide portable storage for extracted content. PBN-TEC recommends using external storage because mobile datasets can become large and because the investigation data can then be separated from the computer’s ordinary internal storage.

Mixed-Device Investigation Workflow

1. Identify the Evidence Source

Determine whether the source is an iPhone/iPad, Android device or SIM/UICC card.

2. Establish Authorized Access

Confirm that the investigator has the appropriate authority and access credentials required by the device and selected tool.

3. Select the Platform-Specific Tool

Use iRecovery for supported iOS devices, Phone Recovery Stick for supported Android devices, or SIM Card Seizure for SIM-resident data.

4. Acquire Accessible Data

Perform the supported extraction or examination process.

5. Review Artifacts

Search, inspect, correlate and bookmark information relevant to the investigation.

6. Export & Store

Export relevant data and maintain the working dataset on appropriate storage.

7. Continue Into the Appropriate Examination Workflow

For formal forensic examination, verification, hashing, reporting and evidence-preservation requirements, apply the organization’s established procedures and appropriate forensic tooling.

What CPIK Is — and Is Not

CPIK Is

• A multi-platform mobile investigation toolkit
• A combination of dedicated iOS, Android and SIM investigation utilities
• A portable solution for repeated mobile-device investigations
• A platform-specific artifact extraction and review workflow
• A practical option for investigators handling mixed-device cases

CPIK Is Not

• A universal forensic extraction engine
• A guarantee of access to every artifact on every device
• A universal deleted-data recovery solution
• A substitute for full mobile forensic platforms
• A complete evidence-management or chain-of-custody system
• A guarantee of forensic admissibility

Who Is CPIK Designed For?

Law Enforcement & Digital Investigation Teams

For repeated mobile-device investigations involving supported iOS, Android and SIM evidence sources.

Private Investigation Agencies

For investigators who routinely need to examine mobile devices as part of authorized investigations.

Corporate Security & Internal Investigation

For authorized examination of company-owned or otherwise lawfully accessible mobile devices during internal investigations, data-loss reviews and security inquiries.

Legal & Litigation Support

For teams that need structured access to mobile artifacts that can subsequently be reviewed and incorporated into appropriate case workflows.

Digital Forensics Training

For educational environments teaching the fundamentals of mobile evidence sources, extraction workflows and artifact examination.

Technical FAQ

What is a Cell Phone Investigation Kit?

CPIK is a multi-platform mobile investigation toolkit combining dedicated tools for iPhone/iPad, Android and SIM/UICC data examination.

What mobile devices does CPIK support?

The kit is designed around iPhone/iPad, Android smartphones/tablets and SIM cards. Actual compatibility depends on the device, operating-system version, access conditions and the individual tool included in the kit.

Can CPIK extract iPhone data?

The included iRecovery Stick is designed to extract and investigate supported iPhone/iPad data. The current CPIK page specifies iOS 16.x and below for that included component, so current-device compatibility must be verified before acquisition.

Can CPIK extract Android data?

Yes, through the included Phone Recovery Stick for supported Android smartphones and tablets. Available artifacts vary by device, operating system, access conditions and application architecture.

Can CPIK recover deleted mobile data?

Deleted-data recovery is conditional, not universal. SIM Card Seizure can recover deleted records that remain on the SIM, while the Android tool describes additional requirements for deleted-data recovery. CPIK should not be marketed as guaranteeing deleted-data recovery from every mobile device.

Can CPIK investigate SIM cards?

Yes. SIM Card Seizure provides a dedicated SIM/UICC examination capability for SIM-resident contacts, messages and call-related records.

Does CPIK bypass phone security?

CPIK should not be represented as a security-bypass solution. Investigators should have lawful authority and the required access to the device before performing an examination.

Does CPIK create a complete forensic image?

The published product documentation does not establish CPIK as a universal physical or filesystem forensic-imaging platform. It is better positioned as a platform-specific mobile data extraction and artifact-review toolkit.

Does CPIK automatically establish chain of custody?

No. Evidence documentation, hashing, verification and chain-of-custody procedures remain part of the organization’s forensic workflow.

Can CPIK be used on multiple phones?

Yes. PBN-TEC describes the kit as an unlimited-use configuration, allowing repeated use across devices subject to the compatibility and update requirements of the individual tools.

Why does CPIK include a 64GB USB drive?

The included drive provides portable storage for extracted datasets and exported case information. PBN-TEC recommends external storage because mobile datasets can become substantial.

Is CPIK suitable for mixed iPhone and Android investigations?

Yes. This is one of its clearest architectural advantages: the kit combines separate iOS, Android and SIM investigation tools in one portable configuration rather than limiting the investigator to a single mobile platform.