One of our most simple methods of extraction for data recovery on a mobile phone is a Logical extraction. A logical extraction is used to extract live data from the phone and will not recover deleted data.
For data recovery, we use forensic tools which talk to the operation system using API which allows data to be extracted from the phone. The data can include 3rd party apps on the phone such as Facebook, SnapChat, Line, Viber, e-mail along with standard information such as MMS, Text, Photographs, Call logs, Notes etc...
We then move on to a file system extraction which will extract data from the internal memory rather than use API to communicate. Here we can extract deleted data. Deleted data generally stays in a space which we term “unallocated space” and can be recoverable. Once the phone needs to free up some space, it will then start to overwrite data in “unallocated space”. Once written over, the data has gone and not recoverable.
The 3rd option is a Physical extraction which is a bit by bit copy of the phone or a full image.
By taking a full image of the phone, we can access all live and deleted data bearing in mind that not all phones are supported for a Physical extraction. If for example; Apple or some of the popular Android phones have up to date security measures, a Physical is not possible.
In all cases, we ask for the make and model of phone and in particular IOS version or security version on androids so we can make a decision before we receive your phone to ensure you know the chances of phone data recovery.
We love mobile devices and if a related news article or anything interests us, we'll post it here!