tecnology

Advances in digital forensic technology provides a deeper access to mobile device data. New technology can extract deleted data from cell phones that were previously inaccessible.  It is important to know the difference between the mobile device forensic extraction levels because each one can recover a different amount of data. A logical extraction obtains the least amount of data. A file system extraction obtains the database files which can recover data that has been deleted. A physical extraction will copy the entire device memory and will recover the most data including unallocated space which can contain deleted data. Not all mobile devices are supported for every level of extraction, but updates to forensic software are released often.  If you had a case involving a mobile device that was only supported for logical extraction, new technology may now be able to access the area where deleted data can be found. Digital forensic experts can quickly determine when new technology updates were released and from that, determine what data can be recovered based off the make and model and operating system of the mobile device. Additional information here Digital Evidence Innocence Initiative White Paper and IRIS LLC Toolbox-Mobile Device Forensics Summary and IRIS LLC Cellebrite Report Quick Start Guide