A client came to ID Forensic’s lab, because the client suspected her spouse of an extramarital affair. Client brought a smartphone to recover deleted text messages, or any other files of interest. The client owned the smartphone of which she allowed her spouse to use. The lead investigator verified the ownership of the smartphone before beginning the investigation occurred. The forensic examiner placed the device in airplane mode to prevent any communication with cell towers. The forensic examiner opened the device with the passcode provided by the client and completed a physical forensic image on the device. The forensic examiner hashed (producing an MD5 hash algorithm that verifies the file system is unchanged after imaging) the image. The forensic examiner began the process of recovering deleted files, retrieving text messages, and other information pertaining to the case. After the investigation, the report was created and the client was given the results during the meeting.