Device intelligence
Handset
Lawful extraction and analysis of mobile device data, in hours instead of weeks, with the results where the investigator is already working.
- Supported device models
- 31,400
- Agencies using Handset
- 1,186
- Median extraction time
- 47 minutes
- First release
- October 2015
Extract
Handset recovers messages, call logs, contacts, photographs, video, location history, app data and deleted content from more than 31,000 phone and tablet models, including current flagship devices.
Examiners connect a seized device to a Handset workstation or a Handset Kiosk in the field. Handset identifies the device, recommends the extraction method, and records the legal authority the examiner enters before it begins.1 Full file system extraction is available for most devices, including many that are locked.
Decode and analyze
Handset decodes data from more than 1,900 apps, and presents it as a single timeline: every message, call, location and photograph on the device, in order, searchable by person, word, place and time. Image classification flags weapons, drugs, currency, documents and material depicting the abuse of children for priority review.
Handset compares contacts, numbers and accounts across every device an agency has examined, so an investigator can see that a number in one case appears in three others.
Into the case, not onto a disk
Results go straight into the relevant case in Concord, with the chain of custody and the legal authority attached. Investigators see the device’s contents alongside everything else in the case, without waiting for a report on a disk, and prosecutors receive a report in the format their courts expect.
Remote collection for authorized government customers
For national security and law enforcement agencies with the legal authority to obtain data from devices not in their possession, Handset offers remote collection capabilities through the Lawful Access Program. Each applicant is reviewed by Tellwright’s Responsible Use Council, must demonstrate its legal authority and independent oversight, and agrees to audit by Tellwright.
Details of the program’s capabilities are provided only in cleared briefings to eligible agencies.2
Configurations
Specifications are subject to change. Detailed data sheets are available in a briefing.
| Handset Lab | Workstation software for digital forensic laboratories; all extraction methods; licensed per examiner |
|---|---|
| Handset Kiosk | Self-service extraction for trained officers at stations and in the field, with consent and warrant workflows; licensed per kiosk |
| Handset Review | Browser-based review of extractions for investigators and prosecutors; licensed per agency |
| Handset Cloud Collection | Collection from cloud accounts with the account holder’s credentials or under legal process |
| Remote collection | Lawful Access Program only |
| Supported devices | 31,400 models across all major mobile operating systems, updated monthly |
| Reports | Court-ready reports with hash verification; export to common forensic formats |
Common questions
Does Handset require a warrant?
Handset requires the examiner to record the legal authority for every extraction: a warrant, consent, or another authority the law recognizes. Whether a warrant is needed is a matter of law in each jurisdiction, and Tellwright requires every customer to follow it.
Can Handset get into locked phones?
For many models, yes. Capabilities vary by model and software version and change often; current support is listed in Handset Lab and in briefings.
Who can buy remote collection?
Only government agencies admitted to the Lawful Access Program, after review by our Responsible Use Council and subject to U.S. export controls.
How is evidence integrity protected?
Every extraction is hashed at the time of capture, and every action taken on it afterwards is recorded in the chain of custody.