Information Technology Reference
In-Depth Information
Manual data extraction
This method of extraction involves the examiner utilizing the normal user interface of the
mobile device to access content present in the memory. The examiner will browse through
the device normally by accessing different menus to view the details such as call logs, text
messages, and IM chats. The content of each screen is captured by taking pictures and can
be presented as evidence. The main drawback with this type of examination is that only
those files that are accessible by the operating system (in the UI mode) can be investigated.
Care must be taken when manually examining the device as it's easy to press the wrong
button and erase or add data. Manual extraction should be used as a last resort to verify
findings extracted using one of the other methods. Certain circumstances may warrant the
examiner to conduct manual examination as the first step. This may include life or death
situations or missing persons where a quick scan of the device may lead the police to the
individual.
