Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Physical data extraction
Physical extraction refers to the process of obtaining an exact bit-by-bit image of the device. It is important to understand that a bit-by-bit image is not the same as copying and pasting the contents of the device. If we copy and paste the contents of a device, it will only copy the available files, such as visible files, hidden files, and system-related files. This method is considered as a logical image. With this method, deleted files and files that are not accessible are not copied by the copy command. Deleted files can be recovered (based on the circumstances) using certain techniques, which we will see in the following chapters. Unlike logical extraction, physical extraction is an exact copy of the device's ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access