Physical Extraction
Definition
An acquisition method that reads the raw storage medium, producing a bit-for-bit image from which allocated and deleted data can both be recovered. Requires bypassing device security and is not always achievable on modern encrypted devices without an exploit or the device passcode.
- Target
- Raw storage medium
- Output
- Bit-for-bit image, allocated plus deleted data
- Common techniques
- JTAG, chip-off, ISP
- Main obstacle
- Device security and encryption
- Risk profile
- Chip-off is invasive and destroys the original chip
Common questions
What is the practical difference between physical extraction, JTAG, and chip-off?+
Physical extraction is the general category of reading raw storage; JTAG uses a device's built-in test access port to read memory without removing chips, while chip-off physically desolders the memory chip from the circuit board, which is more invasive and used only when other methods fail.
Why do examiners try less invasive methods before chip-off?+
Chip-off destroys the original evidence item by removing and often damaging the chip during desoldering, so it is treated as a last resort after JTAG, ISP, or software-based physical extraction have been ruled out or have failed.
Can physical extraction recover data from a locked, encrypted phone?+
Only if the encryption key can be obtained or bypassed, for example through a known passcode, a hardware vulnerability, or vendor cooperation; without that, the extracted image is complete but cryptographically unreadable.
Related terms
- Logical Extraction
- NIST SP 800-101 R1 Level 2 acquisition. Uses the OS-exposed backup APIs (Android ADB backup, iOS iTunes/Finder backup, MTP for media) to...
- Cellebrite UFED
- Cellebrite Universal Forensic Extraction Device. The dominant commercial mobile forensics platform in Indian state cyber cells and at CFSL Hyderabad. Combines acquisition...
- Chip-Off
- NIST SP 800-101 R1 Level 5 acquisition. Desoldering the NAND or eMMC chip from the PCB and reading it directly with a...
- Device Profile
- A vendor-maintained database entry describing how to communicate with a specific make, model, and firmware version of a mobile device. The profile...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- JTAG
- Joint Test Action Group standard (IEEE 1149.1) for chip-level debugging. The test access port left on a phone's PCB lets a forensic...
- NIST CFTT
- The National Institute of Standards and Technology Computer Forensics Tool Testing programme. It publishes independent test reports for digital forensic tools, including...
- PCAP File
- A packet capture file storing raw network frames in the libpcap format. PCAP files are the standard exchange format between network forensic...
- Zeek (Formerly Bro)
- An open-source network analysis framework that processes live traffic or PCAP files and produces structured per-session log files covering DNS, HTTP, SSL,...
Explained in these topics
- Mobile and Network Forensics Toolchains
- Mobile Phone Forensics: Acquisition, JTAG and Chip-OffNIST SP 800-101 R1 Level 4 acquisition. Bit-for-bit image of the device's NAND flash, including unallocated space, system partitions and app sandboxes. Require...