Practical Mobile Forensics - Third Edition

Manual data extraction

This method of extraction involves the examiner utilizing the normal user interface of the mobile device to access content present in the memory. The examiner will browse through the device normally by accessing different menus to view the details such as call logs, text messages, and IM chats. The content of each screen is captured by taking pictures and can be presented as evidence. The main drawback with this type of examination is that only the files that are accessible via the operating system (in UI mode) can be investigated. Care must be taken when manually examining the device, as it's easy to press the wrong button and erase or add data. Manual extraction should be used as the last resort to verify findings ...