MOBILedit Forensic Express can perform physical extraction to create a bit-by-bit image of the data in the phone.
Please note: physical acquisition and analysis is available only in the unlimited phone license; the single-phone license does not support physical acquisition and analysis.
In order to perform a physical extraction, you need to root the phone. If the phone is not rooted you will not be able to perform the physical extraction.
Please note: physical extraction (or rooting) does not apply to iPhone or devices running on iOS.
Physical extraction can also be performed on some Android phones utilizing exploits in their security system, for example, a set of MTK
chipset-based phones and some LG
If the phone is in a rooted state and has been connected successfully, the "Create physical image" button will be displayed under the picture of the phone:
Then confirm root access on the phone (a popup will appear on your phone´s screen, please tap on "Grant Access") and click OK:
Choose a name for the image file to be created, make sure you have enough space on the destination drive (the physical image will be as big as the full phone´s storage):
You will see cloning of the phone start as shown below:
After the physical image is created, the image can be loaded into MOBILedit Forensic Express and then analyzed with results presented in a report.
Please note that the Physical Image creation option is ONLY available in the Unlimited version of MOBILedit Forensic Express.
The option to import a Physical Image is in addition available also in the Applications Analyser of ours.