Physical extraction is a bit for bit copy of a mobile device's storage. Where it succeeds, it reaches deleted messages, orphaned media, application databases and system journals that a logical extraction cannot see. It is the most complete picture a forensic examiner can produce of a handset.
What it can reach
- Deleted messages that remain in database journals or unallocated space.
- Media that has been removed from gallery view but still exists on disk.
- Application data for messengers, dating platforms, banking apps and vaults.
- System artefacts such as usage logs, notification history and location caches.
What it cannot always reach
Modern iPhones and recent Android devices use hardware backed encryption tied to the passcode. Without the passcode, or a supported exploit for that particular hardware and firmware combination, a physical image may be encrypted at rest and unreadable. Solicitors should treat any promise of guaranteed unlock with caution. Reputable examiners will tell you what a specific device supports before quoting on it.
When to instruct a physical extraction
If deletion, denial or the absence of a message is in issue, physical extraction is usually the only route to a defensible answer. If the case turns on messages that are still visible on the handset, a lighter method may be proportionate. The right method is the one that answers the question in the case at the lowest cost.
Ask the examiner what depth of extraction your specific device model and OS version supports, before you commit your client to a strategy.