A typical serious case now arrives as several handsets extracted with different tools. One phone went through the unit's own lab. A second was extracted by a partner agency with a different vendor's software. A laptop came in as a disk image, the carrier records as spreadsheets, and a mailbox as a PST file. Each of those outputs opens cleanly in the tool that produced it, and in nothing else.
The analysis platform, if there is one, usually accepts one of these formats natively. Everything else has to be turned into something it can read. That conversion work is where cases stall, and it is rarely counted when a unit estimates how long an investigation will take.
Where the weeks actually go
The conversion itself is mechanical. An analyst exports reports from the second vendor's reader, flattens chats into spreadsheets, pulls media out into folders, and re-imports the lot. For one handset that might take a day. For a case with five devices from three tools it takes weeks, and the queue for the analysts who know how to do it is already long.
The delay compounds. Nobody wants to start correlation on a partial picture, so the whole case waits for the slowest conversion. By the time the last device is ready, the first has often been re-extracted with a newer tool version and the work has to be repeated. Units that track this honestly tend to find that preparation takes longer than analysis.
What conversion throws away
The larger problem is what does not survive the trip. Extraction packages are not just files. They carry the vendor's decoding of app databases, recovered and deleted records, the path each artefact was found at, time zone handling, and in many cases a hash or digital signature over the whole package. A report exported for import into another tool keeps the parts its author thought to include.
The losses are specific and predictable. Deleted messages that the original tool recovered are often missing from the export. Attachments lose the link to the message they arrived with. Timestamps are rendered as text in one time zone and re-parsed in another. Some tools re-export each Android provider as its own small database rather than as the original message store. A reader that does not recognise that layout files the SMS, MMS and contacts as unsupported, and they never reach the case. On one recent case that layout alone hid several hundred messages and contacts until the parser learned to read it.
Provenance suffers most. Once a chat has been flattened into a spreadsheet, the chain from the finding back to a specific record in a signed package is broken. The finding may still be right, but showing where it came from now depends on an analyst's notes rather than on the evidence.
Reading the package as it arrived
The alternative is to read each package in its native form. That means unpacking the UFDR, the XRY file, the AXIOM case or the Oxygen export directly, validating the vendor signature where there is one, and keeping the internal path of every item so it can be cited later. Disk images and mailboxes are treated the same way: opened as they are, not exported first.
Once every source is read natively, the formats stop mattering for analysis. A handset from one vendor, a computer image from another and carrier records from a third sit in the same case and are correlated against each other. A phone number in a chat on the first device links to a call record and to a contact card on the second without anyone having lined the formats up.
This is not a convenience feature. It decides whether a mixed-source case can start this week or next month, and whether every finding can be traced to the original package rather than to an intermediate export.
What to ask before the next case
A few questions separate platforms that handle mixed extractions from those that only claim to. Which vendor formats are read natively, and which need an export first. Whether deleted and recovered records survive ingestion. Whether a finding links to the item inside the original package or to an imported copy. Whether vendor signatures are checked on ingestion. And what happens when a vendor changes its format, because they all do, usually in the month a large case arrives.
The simplest test is the one most evaluations skip: bring a real case with devices from at least two tools and see how long it takes before analysis can begin. If the answer involves a conversion plan, the platform has moved the work back to your analysts.