Logical extraction asks the mobile operating system, through its own supported interfaces, for the data it is willing to hand over. Physical extraction ignores the operating system where possible and takes a bit-for-bit image of the underlying storage. Between the two sits a spectrum — file system, full file system, agent-based — that most modern instructions actually live within. All are valid. They answer different questions, at different cost, with different admissibility considerations.
The extraction ladder, in plain terms
| Method | What it reaches | Typical cost/time signature |
|---|---|---|
| Logical (backup-style) | Visible messages, contacts, call logs, some media | Hours; lowest cost; broadly supported |
| File system | Accessible file system including some app databases | Same day; moderate cost; requires AFU and pairing |
| Full file system | Complete file system, protected containers, journals | 1–3 days; higher cost; requires vendor exploit support |
| Physical (BFU/AFU) | Bit-for-bit image of raw storage | 2–7 days; highest cost; narrowest device support |
| Chip-off / JTAG | Direct read of NAND after de-soldering or test points | 1–2 weeks; specialist cost; damaged/unbootable only |
Use logical extraction when
- The question is what is currently on the device, and no allegation of deletion is in issue.
- The device model or firmware is not fully supported for a deeper method by any current tool chain.
- Time or budget is tight and a proportionate preliminary view is needed to inform the next step.
- The instructing party wants to reconcile screenshots exhibited by the other side against the source device.
- The device is under continuing use by a co-operating custodian and cannot be removed for a full acquisition.
Use full file system or physical extraction when
- Deletion or the absence of a message is in issue, and unallocated space or SQLite WAL journals need to be recovered.
- Application databases (WhatsApp, Signal, Telegram, banking apps, dating apps) need to be interrogated for message attribution, timestamps and metadata a logical extraction does not surface.
- System artefacts (KnowledgeC and biome on iOS; usagestats, notification history, location caches on Android) are required to establish a pattern of use, presence or absence.
- The case is likely to be contested on the completeness of the record and any missing content will be attacked in cross-examination.
The decision, translated into a scoping call
- 01State the pleaded question. Not "look at the phone" — the specific factual assertion the report is expected to test.
- 02Identify the artefacts that would answer it. Visible messages? WAL-journal recoverable messages? Location history? App-installed timestamps? The artefact class dictates the minimum extraction depth.
- 03Confirm device support at that depth. The examiner checks the exact model and firmware against current Cellebrite, GrayKey, XRY and MSAB support matrices. If the depth is not supported, the instruction is re-scoped, not fabricated.
- 04Confirm state and passcode. BFU or AFU? Passcode available under section 49 RIPA or by consent? Both facts materially affect what is realistically achievable.
- 05Choose the lightest method that reaches the artefacts. Deeper methods are more expensive, longer, and — on some devices — carry acquisition risk. Depth for its own sake is not proportionate.
The right method is the one that reaches the artefacts required to answer the pleaded question, at the lowest cost — not the deepest one on the price list.
Where the choice affects admissibility
A logical extraction is admissible; so is a full file system or physical extraction. Admissibility is not usually the question. The question in cross-examination is completeness: could this method have missed the very material the case turns on? An examiner who has chosen the lightest defensible method — and has clearly stated in the report what that method cannot reach — will hold up. An examiner who has chosen a shallow method to save time, and has not explained the limitation, will not.
Frequently asked questions
No. It is deeper, longer and more expensive, and on many modern devices it is not supported at all. On a device where a full file system extraction reaches the artefacts required, physical is over-specification.
You can, but a proportionate instruction picks the deepest method genuinely required and stops there. If a full file system extraction reaches the required artefacts, a physical adds cost without evidential value in most cases.
Physical is a bit-for-bit image of raw storage; full file system is a complete copy of the decrypted file system. On modern iOS and Android devices, full file system typically produces equivalent evidential value to physical and is the more common deep method today.
The report should set out, in plain English, what was acquired, why that depth was proportionate to the pleaded issue, and what artefact classes lie outside the chosen method — so the reader understands both the reach and the limits of the evidence.
Sometimes. A logical extraction can be superseded by a deeper acquisition on the same device provided the device is still available, unchanged, and still supported by current tooling. Every day of continued use narrows the recovery window.