Not all mobile phone extractions are created equal.

Your devices store thousands of megabytes of data, and choosing what kind of extraction you need is crucial.

Mobile phone extraction is the process by which analysts access and analyze all of your device’s data. Depending on what you are looking for, there are four different types of extraction an analyst might use. The first of these is manual extraction. This is when an analyst simply looks through the device itself and takes whatever information is in the open. If manual extraction does not yield the desired results, an analyst will move on to logical extraction. This process involves moving all the files from your device onto a computer. This process is similar to manual extraction in what can be accessed, however, the transference of the data onto a computer allows for some further discovery. Logical extraction can see basic data such as calls, messages, and contacts.

If you are looking for more file-based data, file system extraction grants access to all files on a device, including anything hidden. On a mobile phone, this includes things such as user data, settings, and application data. This also would include any data that was attempted to be hidden by the user through applications or other methods.

However, physical extraction is the only method of extraction that has the potential to access deleted files. Not only can physical extraction access everything file system extraction can, but it also delves into freespace that may include deindexed data. Data that is deindexed includes data that may have been deleted, such as text messages, that have not yet been overwritten.