Practical Mobile Forensics - Third Edition

Logical acquisition

Logical acquisition is about extracting the logical storage objects, such as files and directories, that reside on the filesystem. Logical acquisition of mobile phones is performed using the device manufacturer application programming interface to synchronize the phone's contents with a computer. Many of the forensic tools perform a logical acquisition. It is much easier for a forensic tool to organize and present the data extracted through logical acquisition. However, the forensic analyst must understand how the acquisition occurs and whether the mobile is modified in any way during the process. Depending on the phone and forensic tools used, all or some of the data is acquired. A logical acquisition is easy to perform ...