At the FutureCrime Summit 2026, a workshop titled “Mobile and Cyber Forensics: Live Extraction and Evidence Analysis Demo” focused on the practical processes involved in extracting, examining and interpreting digital evidence from mobile devices during cyber and criminal investigations.
The workshop was led by Ajay Sariyal of MSAB and placed hands-on digital forensics at the centre of the session. With smartphones now containing communications, application data, photographs, location information and other potentially important digital records, mobile-device examination has become an increasingly significant component of modern investigations.
Mobile Devices Have Become Critical Sources Of Evidence
Mobile phones can contain extensive digital information capable of helping investigators understand events, communications and relationships relevant to an investigation. The challenge, however, is not simply accessing the information stored on a device. Digital evidence must be handled carefully so that investigators can preserve its integrity while determining which information may be relevant to a case.
The workshop’s live extraction component highlighted the practical nature of this process. Instead of approaching mobile forensics only as a theoretical discipline, the demonstration placed attention on how forensic professionals work with devices and extract information for subsequent examination.
This distinction is particularly important because modern smartphones contain multiple applications, operating-system components and different categories of user-generated data. Investigators may therefore need specialised forensic capabilities to identify and organise information that could contribute to an investigation.
Extraction Is Only The Beginning
Obtaining information from a mobile device represents only one stage of a forensic examination. Once data has been extracted, investigators must analyse it to determine what is relevant and how different pieces of information may relate to one another. Large amounts of digital material can require careful examination before investigators can identify meaningful evidence.
The “Mobile and Cyber Forensics: Live Extraction and Evidence Analysis Demo”, led by Ajay Sariyal of MSAB, placed extraction and analysis within the same investigative workflow. Evidence analysis may involve examining communications, files and other digital records recovered during the forensic process. The objective is not merely to collect as much information as possible, but to identify material that can help investigators understand what occurred. The workshop therefore highlighted the difference between possessing forensic technology and being able to interpret its results effectively.
Evidence Integrity Remains Central To Digital Forensics
Digital forensic work also carries an important responsibility: evidence must be handled in a manner that preserves its reliability. During an investigation, forensic professionals need procedures that minimise unnecessary changes to original data and ensure that examination activities can be properly documented. This is particularly important when findings may later form part of an investigative or legal process. A live demonstration offers participants an opportunity to see how forensic extraction fits within this broader requirement for careful evidence handling.
As digital investigations become more complex, the importance of trained personnel also increases. Forensic tools can assist with acquiring and organising information, but investigators still need the expertise required to understand what the recovered data means within the context of a case.
From Digital Data To Investigative Evidence
The broader message of the FutureCrime Summit workshop was that mobile forensics is not simply about accessing a device. Effective examination requires a combination of extraction, analysis, interpretation and responsible evidence handling.
The session led by Ajay Sariyal of MSAB demonstrated why practical forensic capabilities are increasingly important for investigators working in environments where mobile devices can contain substantial amounts of potentially relevant digital evidence.
As smartphones and connected technologies become even more deeply embedded in everyday life, mobile-device evidence is likely to remain a significant part of cybercrime and broader criminal investigations. The ability to extract that information carefully and analyse it effectively is therefore becoming a core component of modern digital forensics.
