Mobile evidence guidance
What is the difference between logical and file-system extraction?
A logical extraction obtains data made available through supported services or APIs. A file-system extraction can provide a broader view of application containers and system artefacts. Neither label alone guarantees completeness.
Potential evidence sources
Where relevant records may exist.
- Logical acquisition output
- File-system acquisition output
- Backup and cloud collections
- Tool logs and acquisition reports
- Device and software metadata
- Validation against the live interface where appropriate
Decision factors
What materially changes the prospects.
- 01Device support and lock state
- 02Required applications and date range
- 03Whether deleted or system artefacts matter
- 04Proportionality and risk
- 05Available time and authority
Evidential limitations
What must not be overstated.
Tool terminology varies
A larger extraction is not automatically more accurate
Some data remains inaccessible even in file-system output
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
