Physical Acquisition
Definition
An extraction method that reads the raw flash storage of a mobile device, bypassing the operating system. Produces a bit-for-bit image of the storage chip, enabling recovery of deleted data and file system metadata, but is blocked by full-device encryption unless the key is available.
- Target
- Raw flash storage chip
- Output
- Bit-for-bit image of storage
- Bypasses
- Operating system
- Recovers
- Deleted data and file system metadata
- Main obstacle
- Full-device encryption without the key
Common questions
How does physical acquisition differ from logical acquisition on a mobile device?+
Logical acquisition asks the operating system for the files it is willing to hand over, similar to a backup, while physical acquisition reads the flash memory directly, which is why it can recover deleted messages and file fragments that a logical extraction never sees.
Why can't investigators always perform a physical acquisition on a modern smartphone?+
Most current-generation phones encrypt storage by default and tie the encryption key to secure hardware, so without the passcode, a valid backup key, or a chip-level exploit, the raw image obtained is unreadable ciphertext rather than usable data.
Does physical acquisition risk altering the evidence?+
A properly conducted physical acquisition uses a write blocker or a forensic tool designed not to modify the source chip, and examiners verify the image against a cryptographic hash to confirm it matches the device state at the time of capture.
Related terms
- Chain of Custody
- The documented history of possession, handling, storage and transfer of an exhibit. It supports traceability between collection and examination, while the significance...
- Logical Acquisition
- An extraction method that uses the device's own operating system interfaces, such as iTunes backup or Android Debug Bridge, to export the...
- Packet Capture (PCAP)
- The interception and recording of network packets as they traverse an interface. The raw data is stored in PCAP format and analysed...
- Cell Site Analysis
- The use of records from mobile network operators showing which cell towers a device connected to and when, allowing investigators to establish...
- Faraday Isolation
- Shielding a mobile device from radio frequency signals (cellular, Wi-Fi, Bluetooth, GPS) using a Faraday bag or cage, preventing network connections that...
- IMEI (International Mobile Equipment Identity)
- A unique 15-digit number permanently assigned to a mobile device's hardware. Used by networks to identify and block stolen devices, and by...
- Write Blocker
- A write blocker prevents supported write commands from reaching specified source media during acquisition. Its effectiveness depends on the interface, configuration and...
Explained in these topics
- Digital Evidence in Mobile and Network Contexts
- Mobile and Network Forensics: Scope and DisciplineA bit-for-bit image of a device's storage chip, capturing allocated and unallocated space, deleted file fragments, and file system metadata. More powerful than...