Logical extraction

NIST SP 800-101 R1 Level 2 acquisition. Uses the OS-exposed backup APIs (Android ADB backup, iOS iTunes/Finder backup, MTP for media) to copy files the OS chooses to expose. Fast and non-destructive but limited to what the OS reveals; system files, deleted records and many app sandboxes are not included.

Explained in

Mobile Phone Forensics: Acquisition, JTAG and Chip-Off

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.

Continue learning Create Your Account

Logical extraction

Explained in

Related terms

Your journey to becoming a forensic professional starts here.