Logical extraction copies the data the operating system is willing to hand over through its own interfaces. Physical extraction takes a bit for bit image of storage. Both are valid. They answer different questions.
Use logical extraction when
- The question is what is currently on the device.
- The device is not fully supported for a deeper method.
- Time or budget is tight and a preliminary view is needed.
Use physical or file system extraction when
- Deletion or absence of data is in issue.
- Application databases and system journals need to be interrogated.
- The case is likely to be contested on the completeness of the record.
The practical rule
Ask the examiner what the specific device model and firmware supports, and choose the lightest method that answers the pleaded question. Anything more is disproportionate. Anything less will not survive challenge.