Mobile Forensics · Forensics Foundations · Lesson 4 of 5

Types of Acquisition

Compare the ways examiners collect a phone's data, from photos of the screen to cloud.

From the screen to the file system

Acquisition is the second phase of the process: collecting data from the phone so it can be examined. There isn't one way to do it. NIST describes a ladder of methods. Each step up gets more data, but needs more skill and more time, and carries more risk of changing or damaging the phone.

The three you'll hear about most:

• Manual acquisition. The examiner uses the phone's own screen, opening apps and photographing or filming what appears. It needs no special tool, but it's slow, it can't recover deleted data and every tap risks changing something. SWGDE calls it a last resort and recommends recording it on video.
• Logical acquisition. A forensic tool connects to the phone, usually by cable, and asks the operating system for data, such as contacts, messages, call logs and photos. The phone decides what to hand over, so this is often similar to what a backup contains. It's fast and widely used, but limited to what the system is willing to share.
• File system acquisition. This collects the phone's files and folders, including app databases and system files that a logical acquisition misses. A full file system (FFS) acquisition aims for every available active file. SWGDE notes it can include remnants of deleted data, for example old records still sitting inside an app's database file.

Which one is possible depends heavily on the phone's model, its software version and its lock state. A phone in AFU usually allows far more than one in BFU, which is why the previous module stressed keeping power on. An examiner picks the method that fits the case, the authority and the device, then records exactly which tool and version did the work.

You'll meet app databases and how deleted records can survive inside them later in this track.

Physical images, clouds and write-blocking

At the top of the usual ladder is physical acquisition: a bit-for-bit copy of the phone's storage chip, including empty space where deleted data might linger. On older phones this was a prize. On modern iPhones and Android phones it's rare, because the storage is encrypted. You learned in iOS Internals that each file has its own key, protected by keys tied to the passcode. A raw copy of the chip is mostly scrambled data. SWGDE notes that methods at the time of writing don't allow decrypting file-based encrypted data this way. Some physical methods, like removing the chip, also destroy the phone.

Much of a person's data isn't only on the phone anyway. Other sources include:

• Cloud accounts, such as iCloud or a Google Account, holding photos, messages, backups and location history.
• Computer backups, saved on a laptop the phone has synced with.

Cloud data usually needs its own legal authority, often a request served on the company that stores it. In the US, the Stored Communications Act sets many of those rules. And if a user turned on end-to-end encryption, such as Apple's Advanced Data Protection, the company may not be able to read much of it.

Now, a key difference from computers. When examiners copy a laptop's drive, they usually use a write-blocker, a device that lets them read the drive while blocking any writes to it. With a phone, the storage is built in and encrypted, and every acquisition means talking to the phone's running operating system. SWGDE says there's no write-blocking method for the phone itself. So examiners keep careful notes, use tested tools and explain any changes.

Tools come in categories: acquisition suites, analysis software, cloud collection tools and shielding and power gear.