The smartphone tells the story of a person's life better than any other device: messages, photos with locations, calls, movements, installed apps, linked accounts. That is also why it is the most delicate exhibit to handle. A wrong move in the first few minutes can wipe data that no later analysis will be able to recover.
The first minutes: isolating the phone
A phone that is on and connected keeps receiving data: new messages, synchronisations, app updates. Some services also allow remote wiping. The first concern is therefore to stop the device from communicating with the outside world.
- If the phone is on and unlocked, switch on airplane mode and turn off Wi-Fi and Bluetooth, noting the time. Keeping it unlocked, for example by connecting it to a power source, can be decisive, because after a restart much of the data stays encrypted until the passcode is entered.
- If it is on and locked, keep it on and powered, isolated from networks, for example in a shielded bag.
- If it is off, leave it off.
Every choice should be recorded and, where possible, photographed.
Types of extraction
There is no single way to "copy" a phone. Techniques differ in how much data they yield and how invasive they are.
| Type | What it obtains | Notes |
|---|---|---|
| Manual | What appears on screen | Screens are photographed; a last resort |
| Logical | Data exposed by the system, similar to a backup | Fast and minimally invasive, but incomplete |
| File system | Most of the file system, including app databases | More complete; requires specific tools |
| Physical | Copy of the entire memory | Increasingly rare on modern devices because of encryption |
Logical extraction
It uses mechanisms provided by the operating system, such as backup. It yields contacts, messages, photos, call logs and part of the app data. It is often the first step, because it is quick and does not require deep intervention.
File system extraction
It gives access to apps' internal databases, which contain messages, histories and metadata not found in the backup. In many cases it requires the phone to be unlocked and the use of specialised forensic tools.
Physical extraction
This was the most complete technique on older phones. Today, full-memory encryption, standard on iPhones and on most recent Android devices, makes a raw memory copy of little use without the decryption keys.
iPhone and Android: practical differences
On iPhone the ecosystem is uniform: few models, one operating system, updates adopted quickly. This makes procedures predictable, but security is also high and consistent.
Android is far more fragmented. Different manufacturers, customised system versions, different processors: what works on one model may not work on another. On the other hand, it sometimes offers more alternative routes.
In both cases, the unlock passcode is often what makes the difference between a rich extraction and a very limited one.
What data can be found
- Messages and chats, sometimes including deleted conversations still present in app databases.
- Photos and videos, with metadata showing date, device model and often location.
- Locations, recorded by the system or by individual apps.
- Call logs and contacts.
- Browsing history and searches.
- Linked accounts, which point to where other data may be found, for example in the cloud.
- Usage data, such as when apps were opened or the screen state, useful for reconstructing activity.
The role of the cloud
Much data no longer lives only on the phone. Photos, chats and backups are synchronised with online services. A complete analysis also considers these archives, which sometimes keep content already deleted from the device. Accessing remote accounts, however, requires the owner's credentials or authorisation, and must be handled carefully so as not to alter the data.
What not to do
- Do not browse the phone "to see if there is anything": every app you open changes data and timestamps.
- Do not install backup or recovery apps on the device under examination.
- Do not perform a factory reset to "unlock" it.
- Do not try random passcodes: many devices slow down or wipe data after too many failed attempts.
In short
- Isolate the phone from networks immediately to prevent changes and remote wiping.
- Extractions can be manual, logical, file system or physical.
- Modern encryption often makes the unlock passcode decisive.
- Useful data includes chats, photos with metadata, locations and usage data.
- Do not browse or try to unlock the phone before acquisition.