Comparing logical extraction vs file system extraction
Updated June 12, 2024
Without access to Magnet Graykey or Magnet Verakey, law enforcement and private sector businesses need logical acquisitions of unlocked iOS devices . The logical acquisition has been an industry-leading acquisition method used by investigators and forensic examiners because of its simplicity and level of support.
However, device security is one of the biggest roadblocks to completing logical acquisitions. For iOS and many Android device logical acquisitions to take place, device access needs to be granted using a passcode and a trusted connection is required in most instances.
For iOS, logical acquisitions are created by using the Apple File Connection protocol, which iTunes also uses to create a backup. This method is designed to manage an iOS device and, more specifically, transfer user data from one device to the next. This protocol allows an iOS device user to experience a seamless transition whenever upgrading their equipment without using cloud services.
For Android devices, many require developer options to be enabled and the Android Debug Bridge connection enabled to allow for an extraction. For those involved in computer forensic extractions, a logical extraction of a mobile device is very similar to a targeted active file type collection on a computer hard drive. Data found within logical collections is limited compared to a full file system extraction.
Limitations associated with logical extractions
Logical extractions can be beneficial as they are generally supported directly following the release of an iOS update, and you won’t have to wait too long for collection support. Unfortunately, there are still many limitations to them. The most significant limitation is the depth and quality of the data collection. Application developer limitations negatively impact these types of iTunes-style backup deliverables.
Logical extractions contain very little data from third-party applications and these third-party applications can contain the most critical of data to the examination. For example, communications applications such as WhatsApp or Signal would not be included in a logical or iTunes backup. In addition, PowerLog and protected location databases and supporting data like the Keychain file are rendered unrecoverable in a logical extraction.
Lastly, backup encryption passwords enforced by the end user may create significant hurdles for digital forensic investigations by denying access to the data stored once the extraction is completed and ready for analysis. The full file system and accompanying keychain.plist file allows investigators to decrypt encrypted artifacts and end-to-end encryption communication applications.
Full file system extractions with Magnet Graykey and Magnet Verakey
Graykey and Verakey are purpose-built solutions for mobile device forensics, specializing in access and extraction. Moreover, they are powered by our vulnerability research team, Graykey Labs, which has pioneered the development of full file system acquisition methods from mobile devices.
Digital evidence is growing in importance and proving increasingly critical. Digital forensic/incident response (DFIR) personnel must be mindful of the collection methods used in any digital investigation. While the logical extraction is better than nothing, it fails compared to the depth and quality that Graykey and Verakey customers have come to expect.
In a side-by-side comparison of found artifacts, a full file system extraction will have 94% more data than that found in a logical extraction. The full file system allows the extraction of application database files giving the examiner the ability to recover deleted artifacts and manually parse artifacts for unsupported applications in Magnet Axiom and Magnet Axiom Cyber.
We encourage you to experience the Graykey and Verakey difference on all iOS devices. We know that you will be pleasantly surprised at the additional data and actionable intelligence collected.
Want to learn more about the additional data in full file system extractions?
- Blog: Revealing hidden data: Full file system extractions uncovered
- Watch the webinar “Mobile Unpacked: Ep.13 // Unlocking iOS 17’s Secrets – Exploring the Full File System” where we explore what full file system extractions have given us in comparison to standard quick imaging or logical+ style imaging. Topics will include new/moved voicemail storage and transcriptions, the use of multiple SEGB formats, and more!
- Watch the webinar “Data Uncovered: Revealing Truths in eDiscovery with Magnet Forensics Solutions” and hear from Shanon Burgess, digital forensics examiner at Aperture, as he shares four fascinating real-world case studies, revealing the impact of full file system extractions versus logic from mobile devices.
- Blog: How To Get the Most Out of Your Magnet Graykey Extractions