Mobile devices contain both volatile and non-volatile memory. Volatile memory (i.e., Random Access Memory (RAM) is used for dynamic storage, and its contents are lost when power is drained from the mobile device. Non-volatile memory is persistent as its contents are not affected by the loss of power or overwriting data upon reboot (e.g., solid-state drives (SSD) that store persistent data on solid-state flash memory).
Although data present on mobile devices is stored in a proprietary format, forensic tools tailored for mobile device acquisition should minimally perform a logical acquisition for supported devices and report the data present in the internal memory. Tools that possess a low-level understanding of the proprietary data format for a specific device may provide examiners with the ability to perform a physical acquisition and generate reports in a meaningful (i.e., human-readable) format.
Post your comment on this topic.