Manual or automated mobile forensic analysis: which one, and when?
By
Shindan
·
The answer in two sentences
Both, because they meet different needs. Automated analysis checks many phones in a few minutes and can be repeated regularly, while manual analysis goes further on a single phone and remains the tool for in-depth investigations. A sound set-up uses the first to check widely, and calls on the second when indicators or a serious suspicion justify it.
The context
An executive comes back from a trip to a sensitive country. An assistant receives an Apple threat notification. A phone starts behaving oddly. Each time, the head of security or the CISO faces the same question: should the phone be sent to a forensic specialist, or checked with an automated tool?
That assumes the question is asked at all. Cybersecurity skills are in short supply: in 2023, ISC2 estimated that the world needed 4 million more cybersecurity professionals, and mobile forensic analysis is a narrower specialty still. In many of the organisations we meet, an executive's phone thus escapes the checks applied to their computer.
Beyond these alerts, a second question arises: how do you check, regularly, the phones of the people most exposed in your organisation?
The two approaches answer these questions in different ways.
Two approaches to the same question
A mobile forensic analysis examines the traces present on a phone. It looks for indicators of compromise, signs that the phone may have been compromised. It can be carried out in two ways.
Manual analysis: depth, with constraints
In a manual analysis, a specialist collects data from the phone and examines it. The specialist can follow a specific lead, cross-check traces and adapt the examination to the case. That is what makes it the tool for in-depth investigations.
According to Shindan's teams, who also carry out manual mobile forensic analyses, this depth comes with practical constraints:
the phone is immobilised, often for several hours, sometimes for several days, and its owner goes without their main work tool;
the collection gives access to the whole content of the phone;
it requires specialised skills that few organisations have in-house, so the phone is usually entrusted to an external firm;
each analysis is billed as a service, and covers a single phone at a single moment.
These constraints explain why manual analysis is usually kept for cases where there is already a serious suspicion. For an executive, giving up their phone for several days can be reason enough to postpone a check.
Automated analysis: scale, within limits
An automated analysis starts from the logs that the operating system keeps itself, rather than from a full copy of the phone. On iOS, the user can gather them on demand into a file called a sysdiagnose, by pressing and holding both volume buttons and the side button for about a second. On Android, the equivalent is the bug report, which brings together the output of system services, error logs and system messages.
The analysis of these logs takes a few minutes and does not immobilise the phone. It can therefore cover every exposed phone, and be repeated over time.
It has its own constraints. It is limited to what the system has recorded in its logs. It gives a picture of the phone at the time of collection. And it does not replace an in-depth investigation when there is a serious suspicion.
Side by side
Manual analysis | Automated analysis | |
|---|---|---|
Phone unavailable | Often several hours, sometimes several days | A few minutes |
What is examined | The whole content of the phone | The logs kept by the operating system |
Who carries it out | A forensic specialist, often external | The security team, with the tool |
Scale | One phone at a time | Many phones, as often as needed |
Depth | Can follow a specific lead | Looks for indicators in the logs |
Typical use | In-depth investigation | Regular checks, and triage after an alert |
What this means for your organisation
The two approaches are not rivals. They form two levels.
Check widely and regularly with automated analysis: phones used by executives and their close staff, and people travelling to sensitive countries, before and after the trip.
Check after any alert: an Apple threat notification, unusual behaviour, a message that looks suspicious.
Call on manual analysis when it is justified: when the automated analysis reveals indicators, or when a serious suspicion requires following a lead in depth.
This way of working keeps the cost and the immobilisation of manual analysis for the cases that need it.
What Shindan brings
Shindan automates this analysis. It relies on the system logs, the sysdiagnose on iOS and the bug report on Android, to look in a few minutes for indicators of compromise, and for indicators of vulnerability: settings or practices that leave the phone exposed. It covers iOS, iPadOS and Android devices, and is available as a SaaS, desktop or mobile application.
The analysis does not access the content of messages and emails, nor photos, videos or app data. Users can generate the logs themselves, once they have learned the steps. Otherwise, the support team takes care of it: for executives, some of our clients have the support team borrow the phone for a few minutes, during a meeting or a business lunch, to generate the logs and run the analysis before handing it back. The result comes first as a summary report that anyone can read, then as a detailed report for analysts.
This makes it possible to check every exposed phone, as often as needed.
When Shindan finds an indicator of compromise, a manual analysis is recommended: it is often what triggers one. If your teams have the skills, they can carry it out in-house. Otherwise, Shindan's teams can carry out this investigation.
Like any tool, Shindan cannot guarantee that a phone is clean: it tells you which indicators were found, so that you can decide on the next step.
Key takeaways
Manual analysis goes further on a single phone, but immobilises it, gives access to its whole content and calls for a specialist.
Automated analysis starts from the system logs, takes a few minutes and can be repeated across all exposed phones.
Automated analysis is limited to what the system records, and does not replace an in-depth investigation.
The two form two levels: regular automated checks, then manual analysis when indicators or a serious suspicion justify it.
No tool can guarantee that a phone is clean.
Frequently asked questions
Which approach goes further? Manual analysis goes further on a given phone, because the specialist can follow a lead and adapt the examination. Automated analysis covers more phones, more often.
Does automated analysis replace manual analysis? No. It makes regular checks possible at scale, and helps decide when an in-depth investigation is needed.
How long is a phone unavailable during a manual analysis? In practice, often several hours, sometimes several days, depending on the case.
Does Shindan access the content of the phone? No. The analysis does not access the content of messages and emails, nor photos, videos or app data.
When should we move to a manual analysis? When the automated analysis reveals indicators, after a serious incident, or when a suspicion needs to be investigated in depth.
Going further
See what a sysdiagnose contains in our knowledge base: https://kb.shindan.io/kb/ios/sysdiagnose/
Sources
Field experience of Shindan's teams, who also carry out manual mobile forensic analyses (constraints of manual analysis).
ISC2, Cybersecurity Workforce Study, October 2023. https://www.isc2.org/Insights/2023/10/ISC2-Reveals-Workforce-Growth-But-Record-Breaking-Gap-4-Million-Cybersecurity-Professionals
Apple, Apple Platform Deployment, "Use diagnostics to research device issues". https://support.apple.com/guide/platform-support/supd3f43814e/web
Android Developers, "Capture and read bug reports". https://developer.android.com/studio/debug/bug-report
Last updated: 27 October 2026.
Analyze your devices with Shindan
Shindan looks for indicators of compromise and vulnerability on iOS, iPadOS, and Android, without accessing the content of messages, emails, or photos.