Right and if they have a file or group of files that are central to the case, all the accused has to do is say, "those were not on my phone" and then the 'exper

Right and if they have a file or group of files that are central to the case, all the accused has to do is say, "those were not on my phone" and then the 'experts' go back and look at the read-only image to verify. If the phone could have been altered to add data before a forensic image was acquired in a way that looks like it was via normal use (reasonable timestamps, browser logs, etc.) then we'd have a real problem. Cellebrite potentially being used to do this as it reads the image is not that problem.