A Repeatability- and Error-Centered Validation Protocol for MobileDevice Forensic Workflows

Mobile device forensic reliability is highly dependent on device model, operating-system version, access state, extraction pathway, parser behavior, application version, and other workflow conditions. As a result, reliability should be demonstrated under defined and repeatable circumstances rather than inferred from tool identity alone. This paper presents a repeatability- and error-centered validation protocol for mobile device forensic workflows and illustrates its application through a bounded Android logical-acquisition pilot. The study is motivated by the growing need for practical validation methods that address configuration-specific evidence access, parser variability, frequent mobile application changes, cloud-linked artifacts, AI-assisted parsing workflows, and timestamp uncertainty in contemporary iOS and Android examinations. The proposed protocol adopts a controlled laboratory design based on documented ground truth, repeated acquisitions, fixed workflow conditions, explicit treatment of access-state constraints, and stage-based anomaly classification. It defines a compact measurement framework for artifact recovery, false positives, false negatives, timestamp deviation after justified normalization, repeatability across repeated runs, and reproducibility across independently repeated subsets. To demonstrate the reporting model, the paper includes a small scoped pilot using an unlocked Samsung Galaxy S8 and an ADB logical-acquisition workflow. Across three repeated runs, the pilot recovered all 35 scoped user-accessible artifacts and produced identical recovered artifact sets, while also showing the importance of bounding claims because timestamp-delta accuracy, app-private data, deleted artifacts, and cross-device generalization were outside the pilot scope. The main result of the paper is a disclosure-ready validation framework that links measured outcomes to the exact technical conditions under which they were produced. Rather than ranking commercial tools, the paper offers a reproducible framework for generating bounded, reviewable, and defensible validation records for mobile forensic workflows. The pilot is used only to demonstrate recovery and repeatability reporting; timestamp-delta validation remains part of the broader protocol and requires trusted creation-time records in a full deployment.