Remote mobile physical acquisition

Our remote physical acquisition service implies a bit level copy of the entire readable physical data container flash memory of the device. The results of a remote physical extraction are the same with a physical acquisition done In-Lab, just the device does not need to be shipped to us. Creating a physical dump of the device will contain the most data available to be extracted. This is the first method of data acquisition we recommend for any device!

Remote physical acquisition of Android devices

Currently we support remote physical acquisitions of devices with Android up to the latest version. Before actually doing a remote physical data extraction, we need to check the device vendor, the device model and the Android version running on the device. Since we use different techniques for remote physical extractions, it is trivial to know as much informations as possible about your device.

Depending on the device vendors and the chipsets used, we might be able to remotely acquire Android devices which are user locked as well, bypassing the user locks. This is our preferred method for remote physical acquisitions, both the system and user data will remain intact.

When physical extraction at chipset level is not possible, but the device is rooted, physical extraction of the device is also possible. By using this method, user locks are also bypassed and both the system and user data will remain intact.

In case of open devices, you can enable USB debug option from the developer settings. With USB debug enabled, many phones and tablets permit physical extractions over ADB, even if the device is not rooted. Using this extraction method over ADB, both the system and user data will remain intact, but the cache content of the phone and it’s operational timeline will be slightly modified.

If the previously mentioned methods fail, but you know the user screen lock, we can try rooting the device and start the physical acquisition right after that. Generally by rooting the device, its operating system’s filesytem will be minimally modified, but the user data should not be altered in any way. We use this method for physical acquisition as a last resort.

In some situations the remote physical acquisition of the Android devices is not possible. In those cases, it is highly recommended to try our Remote Mobile Filesystem Acquisition or our Remote Mobile Logical Acquisition. The disadvantage of the logical acquisitions is that compared to the physical acquisitions, the deleted data and some metadata informations can’t be extracted from the device.

There are situations when none of the remote acquisition solutions would work. If you encounter such a device, we recommend you using our In-lab Forensics services. Please contact us for any further technical details!

APPLY FOR A FREE REMOTE TEST

Remote physical acquisition of Apple devices

Currently we support remote physical acquisition of Apple devices with Jailbrake. If the device got Jailbrake, the remote physical acquisition will have the same result as done In-Lab locally, just you don’t need to ship the device to us.

If the device doesn’t got Jailbrake, but you know its passcode (or the other types of user locks), depending on the device model and iOS version we can Jailbrake it and start a physical acquisition right after that. The filesystem of the operating system will be modified and also some extra applications will be installed, but the user data should not be modified.

Depending on the data needed, sometimes the physical acquisition of an Apple device is not worth the time and hassle. In those cases, it is highly recommended to try a Remote Mobile Filesystem Acquisition or our Remote Mobile Logical Acquisition. The disadvantage of these logical acquisitions is that compared to the physical acquisitions, some of the deleted data and some metadata informations can’t be extracted from the device.

When for any reasons none of the remote acquisition methods would work, we recommend you using our In-lab Forensics services. Please contact us for any further technical details!

APPLY FOR A FREE REMOTE TEST

Remote physical acquisition of Microsoft devices

Currently we do not support remote physical acquisitions of Microsoft devices. For these devices it is highly recommended to try our Remote Mobile Filesystem Acquisition or our Remote Mobile Logical Acquisition. The remote logical acquisitions are possible only if you know the device user lock and you can unlock the device and allow the USB communication.

If none of the remote acquisition methods would work, because the device is locked, we recommend you using our In-lab Forensics services. Please contact us for any further technical details!

APPLY FOR A FREE REMOTE TEST

Remote physical acquisition of other mobile devices

We encounter on daily basis some older device models and feature phones with branded or other custom operating systems. Depending on the device vendors, device models and the state of the devices (locked or unlocked), in some cases we are able to do remote physical extractions.

In some situations the remote physical acquisition of these devices is not possible. In those cases, it is highly recommended to try a Remote Mobile Filesystem Acquisition or our Remote Mobile Logical Acquisition.

If none of the remote acquisition methods would work, because the device is locked, we recommend you using our In-lab Forensics services. Please contact us for any further technical details!

APPLY FOR A FREE REMOTE TEST