Digital Forensics in Mule Investigations
What examining a phone or computer can and cannot show, and why the data still needs an explanation.
Sources checked 2026-09-17
What digital forensics means
Digital forensics is the careful examination of phones and computers to recover and read the data on them. In a mule account case, that can include messages, banking app activity and call records.
It is different from tracing money through bank accounts. Forensics looks at the device, not the transfers, though the two can happen side by side.
In the police, the Commercial Crime Investigation Department (CCID, or JSJK) at Bukit Aman handles this work in mule cases. [f1]
What a phone check can recover
A forensic check can pull a lot from one phone: messages across apps, call logs, contacts, photos and app activity.
Sometimes content you thought was deleted is still stored on the phone and can be recovered. Time stamps show when things happened.
Together, this shows who you talked to and when. It is detailed, but it only shows activity.
What the data cannot decide
Recovered data shows what happened on a phone. On its own, it does not show why.
A message can be read more than one way. A request to receive money might be part of a scam you fell for, or something else. The data alone does not settle that.
Police detected 46,048 mule accounts in 2023 and 50,295 in 2024 [f4]. In each case, phone data still needs an honest explanation.
Why deleting is the wrong move
If you fear your phone will be checked, you may want to delete things. That can work against you.
The chats that worry you may be the ones that show you were tricked. Deleting them throws away your best evidence, and changing data can create new problems.
Keeping the record lets you show what actually happened.
Your rights over your phone
Under Article 5(3) of the Federal Constitution, you have the right to consult and be defended by a lawyer of your choice. [f2] Use it before deciding whether to open your phone or give passwords.
This does not mean blocking the investigation or hiding data. It means not making big decisions alone, under pressure.
A lawyer can guide what you provide and how, so you cooperate sensibly and stay protected.
Why your intent still matters
Phone data can support a conclusion, but it cannot prove what was in your mind. Penal Code section 424C covers transactions through an account without a lawful purpose. It carries 3 to 10 years in jail, or a fine of RM10,000 to RM150,000, or both. [f3]
What you knew and why you acted still matter to your defence. Data that fits wrongdoing can also fit being tricked, so both readings have to be weighed.
That is why your explanation, backed by the same records, belongs in the case next to the forensic report.
Going through the findings with a lawyer
A forensic report can look frightening: time stamps, app names and bits of recovered chats. On its own it is just data, and it needs context to mean anything.
Ask a lawyer to go through the findings with you, section by section. A message that looks bad on its own can read very differently once the whole conversation is seen.
Give your lawyer the context only you have: who sent a message, what you believed then and what you were promised. The police gather the technical picture, but the human explanation has to come from you. [f1]
Do not try to explain the findings alone or offer conclusions under pressure. You have the right to see a lawyer before you respond. [f2]
Keep your own copies of any chats or screenshots you saved before the phone was taken. Your lawyer can compare them with the report.
Sources
Need a Lawyer for Your Frozen Account Case?
Request Lawyer ContactFor people seeking legal representation. For general information, use our guides and tools.
Independent information resource, not a law firm. We do not provide legal advice. Where appropriate and with your consent, we can connect you with an independent lawyer. Availability and acceptance of a case are not guaranteed. How referral works
What can a forensic check of my phone find?
It can recover messages, banking app activity, call logs, contacts and sometimes deleted content still stored on the phone. It shows who you talked to and when. It does not show why you did something. That still has to be explained.
If my chats are recovered, does that decide my case?
Not on its own. Recovered chats can cut both ways. Messages showing you were misled into lending your account can support your side as much as they raise questions. That is why deleting is unwise: the chats that worry you may be the ones that prove you were tricked.
Should I open my phone or give my passwords?
You have the right to consult a lawyer before a decision like this. What you must not do is destroy or change data, which creates new problems. Get legal advice first, and let a lawyer guide what you provide and how, instead of deciding alone under pressure.
Does forensic evidence prove intent on its own?
No. It shows activity on a phone, not what was in your mind. What you knew and why you acted still matter to your defence. The same data can fit an innocent explanation, so your side has to be heard too.
Related pages
If your situation is a little different, these pages cover the closest topics.
Need a Lawyer for Your Frozen Account Case?
Request Lawyer ContactFor people seeking legal representation. For general information, use our guides and tools.
Independent information resource, not a law firm. We do not provide legal advice. Where appropriate and with your consent, we can connect you with an independent lawyer. Availability and acceptance of a case are not guaranteed. How referral works