Ask what was obtained
“Full extraction” can sound conclusive, but the useful question is which sources were accessible and acquired, by what method, in what device state and with what limitations. A report can be accurate within the acquired material while omitting information outside that acquisition’s coverage.
Logical acquisition generally retrieves data through supported software interfaces or services. A filesystem acquisition seeks accessible files and related structures; physical acquisition seeks a representation of storage at a lower level. These descriptions are not interchangeable, and product terminology should be checked against the actual method and log. None guarantees access to all relevant content on every device.
Why the distinction matters
Application storage, operating-system restrictions, encryption, device state and the available acquisition method can affect what is obtained. A rendered export may contain a narrower selection than the acquired data. Information held remotely or in another account may never have been present in the material examined.
A larger acquisition is not automatically a better answer to every question. The task is to identify what source would address the issue, whether it is available and whether further acquisition is proportionate and technically possible.
Illustrative scenario: an absent message
A report from a logical phone extraction contains no relevant message. Before treating that absence as evidence that the message never existed, establish which application, account, time period and data sources were covered. Determine whether the report is filtered and whether the source acquisition contains data not decoded into the export.
An incomplete source also does not prove that a missing message existed. The correct conclusion may be that the available material cannot answer the question. Preserve that distinction when defining further work.
Integrity and completeness are separate
A checksum can help verify that a defined copy has not changed. It does not show that everything relevant was captured from the device. An acquisition log can record success while still describing a limited method. Review warnings, exclusions, inaccessible areas and the scope of the output alongside integrity records.
Relevant material may include the acquisition type, device and software versions, device state, tool settings, logs, file inventory, recorded errors and the relationship between the acquisition and the supplied report. Do not attempt new extraction steps merely to answer these questions without an agreed preservation approach.
Questions for an independent review
- Which source is required to test the disputed proposition?
- Was that source acquired, accessible but not processed, or unavailable?
- Was the report restricted by category, keyword, date range or export settings?
- What residual uncertainty would further acquisition resolve?
- Would attempting further access change the evidence or require separate expertise?
NIST SP 800-101 Revision 1 explains mobile acquisition methods and limitations. Published in 2014, it is a conceptual reference, not a current device-support list. Actual capability must be established for the device, software and method involved.
Explore forensic acquisition and evidence integrity and mobile-device evidence. A preliminary review can identify the material needed. See the expert profile, transfer checklist and instruction guide.