Physical extraction

MOBILedit Forensic Express can perform physical extraction to create a bit-by-bit image of the data in the phone.

Please note: physical acquisition and analysis is available only in the unlimited phone license; the single-phone license does not support physical acquisition and analysis.

In order to perform a physical extraction, you need to root the phone. If the phone is not rooted you will not be able to perform the physical extraction.

For more information on rooting a phone please visit:  How do i root an Android phone? 

Please note: physical extraction (or rooting) does not apply to iPhone or devices running on iOS. 

Physical extraction can also be performed on some Android phones utilizing exploits in their security system, for example, a set of MTK chipset-based phones and some LG models.

If the phone is in a rooted state and has been connected successfully, the "Create physical image" button will be displayed under the picture of the phone:

Then confirm root access on the phone (a popup will appear on your phone´s screen, please tap on "Grant Access") and click OK:

Choose a name for the image file to be created, make sure you have enough space on the destination drive (the physical image will be as big as the full phone´s storage):

You will see cloning of the phone start as shown below:

After the physical image is created, the image can be loaded into MOBILedit Forensic Express and then analyzed with results presented in a report.

Please note that the Physical Image creation option is ONLY available in the Unlimited version of MOBILedit Forensic Express.

The option to import a Physical Image is in addition available also in the Applications Analyser of ours.

• Related Articles

• Physical Extraction (MTK Hack)

  There is a way of extracting physical image from phones with MediaTek chipsets without root access (rooting the phone).  This exploit method does not work on all MTK-equipped devices, but sometimes it is the only way of acquiring the physical image ...

• Physical Extraction (EDL Hack)

  There is a way of extracting physical images from phones with Qualcomm chipsets without root access (rooting the phone).  This exploit method does not work on all Qualcomm-equipped devices. MOBILedit Forensic Express has implemented this feature and ...

• Physical Extraction (LG Hack)

  The "LG Hack" feature works on all LG smartphones with the new version of LG LAF protocol (this is a service download mode similar to Samsung Odin download mode) One of the first devices to feature this version was the first LG G flagship. Every LG ...

• Data - data extraction log

  Following tab displays information about ongoing extraction: if you select the Data Extraction Log option in the Specific selection, you will get a brief resume of the extraction tab in your report as well:

• Running extraction

  On the left side you will see a log of the extraction which will be saved in the results dictionary as log_full.txt . On the right side you will see the connected device. If you are extracting from more than one device at the time you can toggle ...