This allows procedures such as forensic text message recovery to take place. However, this lays everything bare-even deleted files. This includes hidden and root files, but still no deleted data.įinally, there's a "physical acquisition." This is the hardest kind of acquisition, as it needs special tools to dump a copy of the storage into a file. When investigators want to see hidden data, they use a "file system acquisition." Mobile devices are big databases, and a file system acquisition gives an investigator access to all of the files in the database. This transfer makes it easy for forensic investigators to work with the data but is still unlikely to recover deleted information. This involves transferring data from the phone to a PC.
This doesn't reveal deleted data, so it doesn't tell analysts much.Ī "logical acquisition" provides more detailed data. The simplest is known as "manual acquisition," and it involves searching through the phone normally.
Forensic analysts can perform different kinds of data acquisitions.
0 kommentar(er)
