Phone collection reports: a handoff checklist for review teams

A folder labeled “phone collection” can contain several different things. We recommend identifying three parts so the next person can follow the work:

• The acquired files: the data delivered from the collection.
• The collection record: documentation explaining the source, assignment, process and outcome.
• The review export: material prepared from that data for reading, searching or loading into another tool.

A tool-generated PDF may help explain results, but it does not necessarily document the whole examination. SWGDE’s report-writing guidance, version 1.0 (2018), makes that distinction. Ask which documents describe collection and which present selected evidence or analysis.

For a small matter, a concise handoff may be enough. The useful question is whether someone who did not perform the collection can understand what they received without reconstructing the process from emails.

Look for a matter or collection identifier that connects the documentation to the delivered files. Confirm the phone’s identifying details, the collection date and the person or team responsible. A custodian name alone may be ambiguous when the person has several devices.

Record the collection method and relevant tool versions, along with the requested work, outcome and any exceptions. SWGDE’s report-writing guidance, version 1.0 (2018), addresses item identification, processes, results and supporting documentation. Its mobile-device guidance, version 2.0 (2025), section 4.1, also calls for device documentation and contemporaneous custody records identifying items, transfers and people.

For the receiving team, an actionable check is simple: can you connect this package to this collection, and identify whom to contact if something needs clarification? Keep that reference with subsequent exports too.

Separate what was requested from what was delivered. For example, a report showing messages is not enough to tell you whether calls were outside the assignment, unavailable through the method or omitted from that particular export. Ask before treating an empty section as evidence that no activity occurred.

SWGDE notes that one tool may not extract or present all data from a phone. Its mobile-device guidance, version 2.0 (2025), section 3, explains why results need to be understood in the context of the device and acquisition method.

For MARA, targeted delivery means selected supported categories and necessary supporting files. A broader supported collection is a different scope. Selecting records later in Analyzer is another step. Label the export’s selection so a reviewer can distinguish the delivered dataset from the smaller set being reviewed.

If a hash manifest accompanies the collection, confirm which files it covers and which algorithm was used. Compare each received file with its corresponding value. An archive’s hash and a report generated from its contents describe different files; they are not interchangeable.

NIST SP 800-101 Rev. 1, section 3.4 (2014), explains using hashes to detect changes to acquired data. It also notes that successive acquisitions of a changing phone can produce different hashes. A matching file hash supports an integrity check; it does not establish that every potentially relevant item was collected.

Ask how timestamps are represented in the review output: UTC, a named time zone or another documented convention. Keep the collection date distinct from the times of the messages. Before comparing a chat with another source, confirm that the displayed times are being interpreted consistently.

The receiving team should specify its destination platform and intended use. A readable PDF and an import package serve different needs. Preserve the acquired files and collection documentation alongside working exports, rather than letting a selected report become the only retained copy.

For short-message review, Relativity’s RSMF documentation describes a format that carries normalized conversations, participants, events and attachments. It also explains that attachment relationships must be handled correctly during ingestion. Exporting the file is therefore only part of a successful handoff.

We recommend checking a representative conversation in the receiving tool before reviewing the full delivery. Confirm the participants, message order, displayed times and attachment links. Document the export settings and any selection made during review so another team can understand how the output relates to the source.

Use this as a practical starting point and adapt it to your matter:

• Identify the source phone and collection reference.
• Provide the collection documentation, agreed scope, outcome and any exceptions.
• Include the delivered-file inventory and available integrity information.
• Explain the timestamp convention and any review selections or transformations.
• Confirm the receiving format and how attachments will accompany messages.
• Name the contact for questions about the delivery.

With MARA, your authorized team can access completed collections through the portal. Download the standalone extraction for compatible forensic tools, or open it in MARA Analyzer to review and export relevant data. Analyzer export options include RSMF, CSV, XLSX, PDF and XML. Agree the output your receiving team needs, then keep that output connected to its collection record.