Mobile Device Forensics: What Extraction Can and Cannot Recover

By the Legal Cyber Academy editorial team · September 7, 2026

What mobile device extraction can and cannot recover

Mobile device forensics recovers what a phone's storage and encryption keys still hold at the moment of acquisition — not everything the phone once displayed. A logical extraction returns what the operating system agrees to hand over; a file-system extraction returns application databases and the unallocated space inside them; a physical extraction returns raw memory. Deleted content survives only where it was neither overwritten nor sealed with a key the device has already destroyed. Cloud-backed and end-to-end encrypted material normally has to come from the custodian, not the provider.

The extraction tiers are labels — ask which data stores were acquired

NIST's Guidelines on Mobile Device Forensics (SP 800-101 Rev. 1, 2014) sorts acquisition into five levels: manual extraction, logical extraction, hex dumping/JTAG, chip-off, and micro read. At Level 1, NIST states flatly, "it is impossible to recover deleted information." Level 2 logical acquisitions "involve capturing a copy of logical storage objects (e.g., directories and files)," while Levels 3 and up "entail extracting and recording a copy or image of a physical store (e.g., a memory chip)" — and hex dumping "allows deleted objects and any data remnants present to be examined (e.g., in unallocated memory or file system space), which otherwise would be inaccessible through the use of logical acquisition methods."

The four tiers your examiner is likelier to quote — logical, file system, full file system, physical — come from vendor product documentation. NIST uses "logical" and "physical" too, but has no "file system" or "full file system" tier; Cellebrite's glossary defines a physical extraction as one that "[p]roduces a low-level bit-by-bit copy of the phone's storage device." The labels move as the products move, so do not litigate the label. Ask the examiner to identify by name which containers were acquired: which application databases, which system logs, whether write-ahead logs and journal files came with those databases, and whether unallocated space was captured at all. That list, plus tool name and version, tells you whether an absence in the report is an absence in the world. Two more NIST points belong in any deposition outline: "once a level is used, alternate levels may not be possible," and "[t]he risk of alteration and destruction increases in tandem with the levels." Our guide to reading a forensic report covers the document's remaining anatomy.

Deleted data: why two competent examiners get different answers

The intuition that deleted files linger until overwritten was built for spinning disks. On a modern phone it is close to backwards. NIST describes what happens on an iOS device with Data Protection active: "the file key is obliterated when the file is deleted, leaving encrypted and generally unrecoverable file contents in unallocated space, which render traditional carving techniques for deleted files useless." The bytes may still be there. Nothing can read them.

What survives lives inside allocated containers — mostly SQLite databases, where messages, call logs, browser history, and app state actually sit. NIST notes that "a significant portion of user data is stored within allocated data containers and garbage collection is not generally performed on these containers." Recovery therefore turns on SQLite's housekeeping, and SQLite's documentation explains why results vary:

Deleted rows are not scrubbed by default. "When secure_delete is on, SQLite overwrites deleted content with zeros. The default setting for secure_delete is determined by the SQLITE_SECURE_DELETE compile-time option and is normally off." The intermediate "fast" setting purges "all old content from b-tree pages, but leav[es] forensic traces on freelist pages."
Freed pages are left alone. "Freelist leaf pages contain no information. SQLite avoids reading or writing freelist leaf pages in order to reduce disk I/O." Old content sits there until the page is reused.
Committed changes may not be in the database file yet. In write-ahead logging mode, "[t]he original content is preserved in the database file and the changes are appended into a separate WAL file," and a checkpoint later moves them across. A collection that grabs the database but not its WAL file can miss recent activity — or the pre-change state.
A rebuild destroys the remnants. SQLite's advice to applications that "wish to avoid leaving forensic traces after content is deleted or updated" is to enable secure delete or run VACUUM.

Recoverability is therefore a function of the application's build settings and of how much the phone was used after the deletion — not of how good the examiner is. Continued use overwrites freelist pages. A phone imaged the week of the incident and the same phone imaged four months later are different evidence. That makes preservation timing the highest-leverage decision in the exercise, and it is why a report must state the acquisition date and time.

Encryption sets the ceiling before anyone opens a case file

Apple's platform documentation ties file classes to different key handling. For Complete Protection, "[s]hortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID." The Protected Until First User Authentication class "behaves in the same way as Complete Protection, except that the decrypted class key isn't removed from memory when the device is locked or the user logged out." Android draws a parallel line: credential-encrypted storage is "only available after the user has unlocked the device," becoming readable "in response to first entering credentials at the lock screen," while device-encrypted storage is available during Direct Boot.

Two operational rules follow. First, a phone's state when it reaches the examiner is itself part of the evidence. NIST warns that rebooting "may cause authentication mechanisms to activate preventing further analysis," and recommends that radio communications "are blocked or disabled prior to an examination as well as during transportation" to defeat a remote wipe. Powering a seized handset down is a decision, not a neutral act. Second, the manufacturer is not a backstop: Apple's Legal Process Guidelines state that "[f]or all devices running iOS 8.0 and later versions, Apple is unable to perform an iOS device data extraction as the data typically sought by law enforcement is encrypted, and Apple does not possess the encryption key."

Where the custodian holds the passcode and will not give it up, the fight is legal rather than technical. In criminal matters it is unsettled. The New Jersey Supreme Court held in State v. Andrews (2020), over a dissent, that neither the Fifth Amendment nor New Jersey's own privilege protected the defendant from compelled disclosure of the passcodes to two iPhones seized under search warrants, because on that record the passcodes' "existence, possession, and authentication" were foregone conclusions — while noting that courts elsewhere considering compelled decryption have been "reaching divergent results." Andrews binds only New Jersey, and the U.S. Supreme Court has applied the foregone conclusion exception only to document production.

Civil litigation runs on a different lever, and it is not compelled decryption: it is the court's ordinary discovery-management and sanctions power. As the Sixth Circuit noted in John B. v. Goetz — while declining to approve compelled forensic imaging, and offering sanctions as the less intrusive alternative — a district court "maintains authority to impose sanctions for discovery violations under the federal rules and pursuant to its inherent powers."

Cloud-backed content: the copy you can actually get

Riley v. California already flagged the problem — "the data a user views on many modern cell phones may not in fact be stored on the device itself." Apple's Legal Process Guidelines describe what the account holds: "iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, Business Chat, SMS, and MMS messages and voicemail," and such content "may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent." Where the user has enabled Advanced Data Protection, Apple states it "cannot decrypt certain iCloud content, including Photos, iCloud Drive, Backup, Notes, and Safari Bookmarks," and it says it "has no way to decrypt iMessage data when it is in transit between devices."

For civil practitioners the governing constraint is the Stored Communications Act. Section 2702(a) bars a provider of electronic communication service or remote computing service to the public from divulging the contents of communications, and the exceptions in § 2702(b) run to an addressee or intended recipient, disclosure "with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service," specified law-enforcement process, emergencies, and similar categories. A civil subpoena is not among them. Non-content records sit under a different rule: § 2702(a)(3) bars their disclosure only "to any governmental entity," and § 2702(c)(6) permits disclosure "to any person other than a governmental entity."

So the content you want comes from your opponent — through preservation demands, account exports, and consent — not from the platform. Put it on the agenda at the first meet-and-confer, because retention varies by provider and record type and, as Apple puts it, a provider "does not retain deleted content once it is cleared from [its] servers."

Location artifacts are several different things

"Location data" on a phone is a bundle of unrelated artifacts with different reliability: photo EXIF coordinates, app-specific caches, network association records, and mapping-history databases. An examiner who reports that "the device was at X" without naming the artifact has skipped the analysis. Mapping history has moved: in December 2023 Google announced that Timeline "will be saved right on your device," and that "when you first turn on Location History, the auto-delete control will be set to three months by default" — down from the previous eighteen. The record you assumed sat on a server may exist only on the handset, and only for a quarter.

Carrier cell-site records answer a different question and carry their own gate. In Carpenter v. United States, the Supreme Court held that the Government's acquisition of a suspect's historical cell-site location information from his wireless carriers was a Fourth Amendment search, generally requiring a warrant. It expressly declined to set a minimum period, saying it "need not decide whether there is a limited period for which the Government may obtain an individual's historical CSLI free from Fourth Amendment scrutiny," and that it was "sufficient for our purposes today to hold that accessing seven days of CSLI constitutes a Fourth Amendment search." Seven days is a figure the Court found sufficient on the facts before it, not a safe harbour below which no warrant is needed — and Carpenter governs government acquisition, not civil discovery.

Scoping the protocol so the examination survives objection

Courts do not treat a phone as an open filing cabinet. The Advisory Committee Note to Rule 34(a) says the rule "is not meant to create a routine right of direct access to a party's electronic information system," and that "[c]ourts should guard against undue intrusiveness resulting from inspecting or testing such systems." In In re Ford Motor Co., the Eleventh Circuit granted mandamus and directed that a direct-access order be vacated, holding that "Rule 34(a) does not grant unrestricted, direct access to a respondent's database compilations" and faulting a district court that "established no protocols for the search" and "did not even designate search terms to restrict the search." The court was careful about the limits of that ruling: "some kind of direct access might be permissible in certain cases," but the requesting party was "unentitled to this kind of discovery without — at the outset — a factual finding of some non-compliance with discovery rules." The Sixth Circuit, again on mandamus, set aside compelled forensic imaging in Goetz, holding that it "is not appropriate in all cases, and courts must consider the significant interests implicated by forensic imaging before ordering such procedures" — a decision driven by the privacy and confidentiality stakes and by federalism and comity concerns particular to imaging state officials' computers.

A protocol that engages those authorities generally does six things.

States the proportionality case. Rule 26(b)(1) limits discovery to what is "proportional to the needs of the case," weighing among other factors "whether the burden or expense of the proposed discovery outweighs its likely benefit." Say which factor an image satisfies and why a targeted production will not do.
Names the data stores and the date range. Andrews is a state criminal warrant case rather than civil-discovery authority, but its trial court order is a useful illustration of the unit of limitation: access was confined to what was "contained within (1) the 'Phone' icon and application on Andrews's two iPhones, and (2) the 'Messages' icon and/or text messaging applications." Application-level and date-level limits are the workable unit — not "the phone."
Puts a neutral between the image and the requesting party. Rule 26(c)(1) lets a court limit "the scope of disclosure or discovery to certain matters" and designate "the persons who may be present while the discovery is conducted." A court-appointed neutral or special master who holds the image, runs agreed queries, and releases only responsive hits is a common answer to a privacy objection.
Gives the producing party first review. The examiner's output goes to the custodian's counsel for responsiveness and privilege review before anything reaches the other side — a volume problem worth planning, including any technology-assisted review that will be used.
Gets a Rule 502(d) order first. Under Federal Rule of Evidence 502(d), "[a] federal court may order that the privilege or protection is not waived by disclosure connected with the litigation pending before the court — in which event the disclosure is also not a waiver in any other federal or state proceeding." That cross-proceeding effect is the reason to enter it before acquisition rather than after a problem.
Plans authentication at the front end. Federal Rule of Evidence 902(14) makes "[d]ata copied from an electronic device, storage medium, or file" self-authenticating "if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12)," and the proponent must also meet Rule 902(11)'s notice requirement. Hash values recorded at acquisition are what make that certification available later — the discipline that governs authenticating social media evidence.

Over-collection is not a neutral error: it creates a privacy record someone has to defend, expands the privilege review, and invites the argument that the request was never proportional.