Part 2 of 6

Mobile Acquisition Methods

🕑 120-150 minutes 📖 Intermediate Level 📱 Module 2

Introduction

Mobile data acquisition is the process of extracting data from a mobile device for forensic examination. The method chosen depends on device type, operating system version, security features, and the level of access required. This part covers all major acquisition methods from basic logical extraction to advanced chip-off techniques.

📚 Learning Objectives

By the end of this part, you will understand the five primary mobile acquisition methods, know when to use each method, comprehend the data each method can recover, and appreciate the technical and legal considerations for each approach.

Acquisition Method Hierarchy

Mobile acquisition methods are typically categorized by the level of access they provide and the complexity of implementation. The choice of method affects the completeness of data recovery.

Mobile Acquisition Decision Flowchart
Device Received
Assess device state and access level
Device Unlocked?
YES
Full File System
Maximum data recovery
NO
Bypass Available?
YES - Exploit
Physical/AFU
Exploit-based extraction
NO
Chip-Off / Cloud
Last resort methods
Method Data Access Level Complexity Device State Required
Manual Extraction User-visible only Basic Unlocked, functional
Logical Extraction Backup-level data Basic Unlocked or paired
File System All user files + system Intermediate Unlocked + privilege escalation
Physical Full disk image Advanced Exploit or hardware access
Chip-Off Raw flash memory Expert Any (destructive)
Cloud Cloud-synced data Varies Credentials or legal process

Logical Extraction

Logical extraction retrieves data through the device's operating system interfaces, similar to how the user or backup software accesses data. This is the most common and least invasive method.

📦
Backup-Based Extraction
Basic
Utilizes native backup mechanisms (iTunes backup, ADB backup, Google backup) to extract data. Creates a backup file that can be analyzed.
Advantages
  • Non-invasive
  • Forensically sound
  • Works on locked devices (if paired)
  • Fast and reliable
Limitations
  • No deleted data
  • Apps may opt-out
  • Encrypted backups need password
  • Limited system data
🔌
Agent-Based Extraction
Basic
Installs a forensic agent application on the device that extracts data through OS APIs. Common with tools like Cellebrite UFED.
Advantages
  • More data than backup
  • Real-time extraction
  • App-specific data access
  • Location and sensor data
Limitations
  • Requires unlocked device
  • Agent installation changes device
  • May require app installation
  • OS security restrictions

Logical Extraction Process

1

Pre-Extraction Documentation

Document device state, battery level, airplane mode status, and any visible notifications. Photograph the device screen.

2

Connection Setup

Connect device to forensic workstation using appropriate cable. Ensure USB debugging (Android) or trust relationship (iOS) is established.

3

Extraction Execution

Run the forensic tool's logical extraction. Select appropriate extraction profile based on device and OS version.

4

Verification

Generate hash values of extracted data. Verify extraction completeness by checking expected artifacts.

File System Extraction

File system extraction provides access to the device's file system structure, including databases, configuration files, and some deleted data that hasn't been overwritten.

💡 What File System Extraction Provides

Complete access to the user data partition including SQLite databases (contacts, messages, call logs), application private directories, cached files, system logs, and in some cases, deleted files that remain in unallocated space within the file system.

Methods to Achieve File System Access

  • ADB with Root (Android): If device is rooted or can be temporarily rooted, full file system access via ADB shell
  • Jailbreak (iOS): Jailbroken devices allow SSH access to complete file system
  • Boot Loaders: Custom boot loaders or recovery modes may provide elevated access
  • Agent Privilege Escalation: Some forensic agents can temporarily escalate privileges
  • Vendor-Specific Methods: Certain manufacturers provide diagnostic modes with extended access
Legal Consideration

Rooting or jailbreaking a device for forensic purposes should be documented thoroughly. In India, ensure you have proper legal authorization as modifying device software may raise questions about evidence integrity in court.

Physical Acquisition

Physical acquisition creates a bit-by-bit copy of the device's storage, similar to hard drive imaging in computer forensics. This provides the most complete data recovery including deleted files, unallocated space, and system areas.

💾
Full Physical Image
Advanced
Complete bit-for-bit copy of all storage partitions including system, user data, and unallocated space. Highest data recovery potential.
Advantages
  • Deleted file recovery
  • Complete data preservation
  • Unallocated space analysis
  • File carving possible
Limitations
  • Requires exploit or root
  • Encrypted data challenges
  • Time-consuming process
  • Large storage requirements
🔓
AFU (After First Unlock)
Advanced
Exploits the device state after it has been unlocked at least once since boot. Encryption keys remain in memory, allowing data access without passcode.
Advantages
  • Works on locked devices
  • Decrypted data access
  • No passcode needed
  • Supported by tools like GrayKey
Limitations
  • Requires AFU state
  • Exploit-dependent
  • May not work on latest OS
  • Some data classes protected

Physical Acquisition Techniques

  • JTAG (Joint Test Action Group): Uses device's debug port to read flash memory directly. Non-destructive but requires board-level access
  • ISP (In-System Programming): Connects directly to flash memory chip while still on the board. Bypasses processor security
  • Bootloader Exploits: Vulnerabilities in device bootloader allow unsigned code execution for imaging
  • EDL Mode (Qualcomm): Emergency Download Mode on Qualcomm devices can provide low-level access

Chip-Off Acquisition

Chip-off is the most invasive acquisition method, involving physical removal of the flash memory chip from the device's circuit board for direct reading.

Destructive Method Warning

Chip-off is typically destructive to the device. It should only be used as a last resort when all other methods have failed. Document all attempts at non-destructive methods before proceeding.

Chip-Off Process

1

Device Disassembly

Carefully disassemble the device to access the main circuit board. Document with photographs at each step.

2

Chip Identification

Identify the flash memory chip (eMMC, UFS, or NAND). Research chip pinout and reading requirements.

3

Chip Removal

Use hot air rework station to desolder the chip. Requires precise temperature control to avoid damage.

4

Chip Cleaning

Remove residual solder from chip contacts. Prepare for placement in reader socket.

5

Data Reading

Place chip in appropriate adapter/socket and read using chip reader (UP-828, Medusa Pro). Create binary dump.

6

Data Reconstruction

Parse raw dump to reconstruct file system. May require decryption if device used hardware encryption.

💡 When to Use Chip-Off
  • Device won't power on (water damage, physical damage)
  • Locked device with no available exploits
  • All software-based methods have failed
  • Evidence of critical importance justifies destructive method

Cloud Acquisition

Cloud acquisition targets data stored in cloud services rather than the physical device. As mobile devices increasingly sync data to the cloud, this method becomes essential for complete evidence recovery.

Credential-Based Access
Basic
Using obtained credentials (with consent or legal authority) to access cloud accounts directly. Includes iCloud, Google Account, OneDrive, etc.
Advantages
  • Device not required
  • Historical data access
  • Multiple device data
  • Deleted data (if available)
Limitations
  • Needs credentials or consent
  • 2FA may block access
  • Privacy concerns
  • Data may be encrypted
📜
Legal Process Request
Advanced
Formal legal requests (MLAT, court orders) to cloud service providers for user data. Follows international legal cooperation frameworks.
Advantages
  • No credentials needed
  • Legally defensible
  • Complete account data
  • Metadata and logs included
Limitations
  • Time-consuming process
  • International complications
  • Provider cooperation varies
  • E2E encrypted data excluded

Key Cloud Services for Forensics

Service Data Types Forensic Tool Support
iCloud Backups, Photos, Messages, Keychain, Find My Cellebrite, Oxygen, Elcomsoft
Google Account Gmail, Drive, Photos, Location History, Chrome Cellebrite, Magnet AXIOM, Oxygen
WhatsApp Messages (if backed up to Drive/iCloud) Cellebrite, Oxygen, manual extraction
Microsoft OneDrive, Outlook, Teams Cellebrite, Magnet AXIOM

Selecting the Right Method

Choosing the appropriate acquisition method requires balancing multiple factors including data needs, device state, available resources, and legal requirements.

💡 Decision Factors
  • Device State: Powered on/off, locked/unlocked, damaged
  • OS and Version: Security features vary significantly
  • Investigation Scope: What data is needed for the case
  • Time Constraints: Urgency of the investigation
  • Available Tools: Forensic tools and their capabilities
  • Legal Authority: Scope of warrant or consent
  • Preservation Needs: Must device remain functional?

Best Practice: Layered Approach

Start with the least invasive method and progress to more invasive techniques only if necessary:

  1. Attempt logical extraction first (preserves device, legally defensible)
  2. If more data needed, attempt file system extraction
  3. If device is locked, explore AFU/exploit-based physical acquisition
  4. Chip-off only as last resort when device is non-functional or all else fails
  5. Always consider cloud acquisition as complementary method
📚 Key Takeaways
  • Five primary acquisition methods: logical, file system, physical, chip-off, and cloud
  • Logical extraction is least invasive and should be attempted first
  • Physical acquisition provides most complete data recovery including deleted files
  • Chip-off is destructive and reserved for damaged or inaccessible devices
  • Cloud acquisition is increasingly important as data moves off-device
  • Method selection depends on device state, data needs, and legal authority
  • Always document all acquisition attempts and methods used
  • Hash verification is essential for all extraction methods