The most consequential acquisition decision is often made before a tool starts: what exactly is this examination allowed and expected to establish?
A phone can be powered on or off, locked or unlocked, connected or isolated, damaged or stable, recently used or untouched. Credentials may be available. Consent may cover the device but not every linked account. An application may hold the relevant material locally, in a backup, in a cloud service, or nowhere that the selected method can reach.
Treating all of those conditions as a single “extract phone” task creates avoidable risk.
Start with four facts
Before selecting a method, record:
- Authority: who may instruct the work, what that authority covers, and what is excluded.
- Device state: exact model, operating-system version, power and lock state, credentials available, and obvious damage.
- Objective: the people, applications, dates and factual questions that matter.
- Environment: where evidence may be processed, who may access it, and how outputs must be handed off.
These facts constrain the method. They also allow an examiner to explain later why a particular method was chosen.
Acquisition methods answer different questions
A narrow logical or application export may be proportionate and useful for one matter. Another may require broader filesystem data, backups or an authorised native account export. More data is not automatically better: over-collection increases privacy, review and security burden without necessarily improving the answer.
The important distinction is between what a method could collect in theory and what it did collect under the recorded conditions.
Preserve the output as evidence, not just as a workspace
An acquisition should produce more than a folder an examiner can open. The case record should connect the received device, method, operator, time, tool and version, output files, source identifiers, hashes where applicable, and known failures or warnings.
The original output should be preserved. Review and conversion should occur on controlled copies so the path from a finding back to its source remains visible.
A failed method is still a result
Failed or partial attempts should not disappear from the record. They may explain later device changes, time spent, method choice or gaps in the final dataset. A disciplined report says what was tried, what happened, and whether the attempt changed the device or available evidence.
That is why mobile forensic acquisition is not a button. It is a documented decision under specific technical and authority constraints.
Read the mobile forensics service boundary and the intended examination sequence.