Metafor uncovers more mobile evidence across encrypted apps with limited disruption

The end user in Mike McGowan likes the safeguards baked into mobile applications — but the forensic examiner in him knows those protections are making his job harder and harder.

McGowan is the owner of Metafor, a digital forensics firm in New York City. With 20 years of experience, he encounters devices with encrypted data more often than ever before.

He’s also seen the volume and variety of data steadily grow, with terabyte storage and evidence stretching across personal phones, work phones, messaging apps, and cloud accounts.

Much of the evidence lives inside applications and protected areas of devices that logical collections cannot fully capture. In fact, with critical evidence moving into Signal, Telegram, and other privacy-focused apps, comprehensive extraction has often become the standard.

In some instances, a full extraction can ramp up time and trouble for everyone involved: people don’t like to give up their phones for hours at a time.

To deliver minimally intrusive collections and keep pace with evolving technology — without the resources of a larger forensics team — McGowan needs depth without disruption.

For modern investigations, McGowan turns to Magnet Verakey full file system extraction to gather the complete content of phones. He uses category extraction to target only the material needed for a case.

The challenge, then, is not just accessing the data. It’s accessing it in a timely way clients can feel comfortable with. Targeted collections make gathering data less intrusive while still giving Metafor access to the evidence needed in an investigation.

In one case, the ability to access the full file system extraction was needed to pull Signal messages on a personal device. The custodian was apprehensive about handing over her phone.

McGowan said having Verakey category extractions helped him reassure her they didn’t want her photos, just the communications, and that the turnaround would be swift. He’s not sure she would have said “yes” otherwise.

“Clients have been happy that, ‘Okay, I don’t need to hand over my phone for eight hours.'”

McGowan said he depends on the breadth of artifacts supported by tools from Magnet Forensics. Working together as the foundation for mobile investigations, Verakey and Magnet Axiom Cyber help him stay ahead of thousands of mobile apps available today, something McGowan said he would not be able to keep up with otherwise. He also mentioned that Magnet is quick to release updates amid constant mobile changes and responsive when there are inevitable gaps between releases and forensic support.

“Magnet understands the needs of service providers,” he noted. “Upfront conversations… it’s been critical to our work.”

For Metafor, the combination of deep access, targeted collection, and fast support has become critical to modern mobile investigations. That access helps ensure critical communications and artifacts are not missed simply because they reside outside the reach of less advanced collection methods.

Working as a solo practitioner, McGowan values having a technology partner that extends the capabilities of his practice. Rather than trying to keep pace with thousands of changing devices and apps, he relies on Magnet’s research and rapid updates so he can focus on helping clients answer questions, analyze evidence, and uncover the facts.

As mobile ecosystems continue to encrypt and evolve, McGowan expects the need for reliable access to grow.

“That’s been a key evolution,” he said. “Tools like Verakey are going to be increasingly needed.”