Practical Mobile Forensics - Fourth Edition

Physical acquisition

Physical acquisition of a mobile device is nothing but a bit-by-bit copy of the physical storage. With direct access to flash memory, information can be acquired from the device through physical extraction. Flash memory is non-volatile memory and is primarily used in memory cards and USB flash drives as solid-state storage. The process creates a bit-for-bit copy of an entire filesystem, similar to the approach taken in computer forensic investigations. Physical acquisition is able to acquire all of the data present on a device, including the deleted data, and access to unallocated space on most devices.