Practical Mobile Forensics - Fourth Edition

Manual data extraction

This method of extraction involves you utilizing the normal user interface of the mobile device to access content present in the memory. You will browse through the device normally by accessing different menus to view details such as call logs, text messages, and IM chats. The content of each screen is captured by taking pictures and can be presented as evidence.

The main drawback of this type of examination is that only the files that are accessible via the operating system (in UI mode) can be investigated. Care must be taken when manually examining the device, as it's easy to press the wrong button and erase or add data. Manual extraction should be used as the last resort to verify findings extracted using one of ...