Practical Mobile Forensics - Third Edition

Physical data extraction

Physical extraction refers to the process of obtaining an exact bit-by-bit image of the device. It is important to understand that a bit-by-bit image is not the same as copying and pasting the contents of the device. If we copy and paste the contents of a device, it will only copy the available files, such as visible files, hidden files, and system-related files. This method is considered as a logical image. With this method, deleted files and files that are not accessible are not copied by the copy command. Deleted files can be recovered (based on the circumstances) using certain techniques, which we will see in the following chapters. Unlike logical extraction, physical extraction is an exact copy of the device's ...