Empty Is Not Absent: Silent Failure Modes in Open-Source Mobile Forensic Parsers on iOS 26 and Android 16

A mobile forensic parser written for one release's storage layout can, after a release changes that layout, return an empty table instead of an error, which an examiner cannot tell from an unused feature. We ran the complete artifact sets of an iOS suite and an Android suite of open-source parsers, 2,607 artifact parsers, on two iOS 26 full file system images and one Android 16 image (completion of the Android pass is not established), classified every outcome, and traced zero-row outcomes to the raw stores. About 18 percent of the iOS artifacts matched a file and returned nothing. Among these we isolated at least four drift defects in existing artifacts, of three behaviours (loud abort, silent zero, benign sidecar read), each exposed by a different check. A second failure class produces rows and is invisible to outcome counts: an app-update module that took the first matching database returned only a second user's copy on three Android 16 devices, and none of the primary users' 1,793 rows. A doubling test, in which a second user's copy must double the row count, exposes it. Parsers should therefore report how many files each pattern matched, and tests should include a second user.