Everything a phone held, on one timeline.
Corvid Suite takes a read-only snapshot of an Android phone or an iPhone and lays out what it held, minute by minute: messages, calls, photos, apps, places, and the traces the system keeps.
Forty minutes of one phone: Spotify playing all along, a call that comes in during a game of chess, and the messages that arrive while it lasts. The same events also lie side by side in columns, on a single line, or in a table.
What it reads
And on everything it reads, over 2,000 artifacts ported from ALEAPP and iLEAPP.
- Android phones
- Over USB debugging, with nothing installed on the phone. When it is rooted, Corvid also copies what apps and the system keep to themselves; root is never needed.
- iPhones
- Through a full backup, encrypted ones included, made by Corvid or already made by Finder or iTunes. The backup is read and never changed.
- Extractions
- Full file system extractions made by other tools, as a zip or tar archive. Keys the tool recovered open the apps’ encrypted databases.
Inside a case
A project merges any number of snapshots, of one phone or of several. Every section reads the same events; right-click any of them for what can be done with it.
Conversations as they were held
From every messaging app at once. Messages that an earlier snapshot holds and a later one no longer does are marked as gone.
Everyone the records name
How much each sent, received and called, in which apps, first and last seen. Follow a person to mark them in every view, with your note on who they are.
Who is tied to whom
Across phones. A person two phones both know shows by the lines that cross to them.
When the phone was used
Per day, week or month, by hour of the day, by source. A bar leads to the timeline of that week.
What changed between two snapshots
Records removed; files deleted, moved or changed; and what “no longer there” means for each source.
What deserves a look
Rules that point at records removed, holes in the numbering, the camera used with the screen off, apps from outside the store. A finding is a place to read, not a conclusion.
Made for evidence work
- Read-only. A snapshot is taken once and never changed. Deleting a project keeps its snapshots.
- Hashed. Every record and every copied file gets a SHA-256 when it is taken. Verify a snapshot at any time to show nothing changed since.
- Logged. Everything done to a project is written down with its time, in the order it was done.
- Reported. A printable report: the case, the snapshots with their hashes, every event saved as proof with your note and its raw record, and the log.
- Offline. One program on your own computer. Its pages answer only there, and it fetches nothing from the internet.
- Checked. Compared, minute by minute, with what the makers of public reference images of an Android 14 and an iOS 17 phone wrote down they did.
Talk to us
Ask for a demo on your own test phones, a trial for your lab, or whether Corvid reads the apps and phones you work with.