What is the difference between logical, file-system and physical extraction?¶
title: What is the difference between logical, file-system and physical extraction? subtitle: They describe different levels of access to device data, but the exact meaning varies between tools and devices. slug: what-is-the-difference-between-logical-file-system-and-physical-extraction series: mobile-extraction-and-reader-reports section: understanding-what-you-have card_type: question_card pathway_order: 6 section_order: 5 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 528 estimated_read_time_seconds: 218 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - logical extraction - file-system extraction - physical extraction - acquisition sources: - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: SWGDE Best Practices for Mobile Device Evidence Collection, Preservation, Handling and Acquisition url: https://www.swgde.org/documents/published-complete-listing/18-f-003-swgde-best-practices-for-mobile-device-evidence-collection-and-preservation-handling-and-acquisition/ - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST Computer Forensics Tool Testing: Mobile Devices' url: https://www.nist.gov/itl/csd/secure-systems-and-applications/computer-forensics-tool-testing-program-cftt/cftt-7
What is the difference between logical, file-system and physical extraction?¶
They describe different levels of access to device data, but the exact meaning varies between tools and devices.
Script¶
Logical, file-system and physical extraction are broad descriptions of how data was obtained from a mobile device.
They are useful.
They aren’t universal promises about exactly what the examiner received.
A logical extraction normally asks the operating system, an application interface, a backup service or another supported mechanism to provide available data in a structured form.
It may recover common user information such as contacts, messages, calls, media and selected application data.
Because the operating system controls what is returned, a logical extraction can be limited.
It may not provide every application file, protected area, deleted remnant or item outside the supported interface.
The advantage is that the returned data is often already organised at a higher level and can be easier for the tool to present.
A file-system extraction aims to obtain a broader set of files, directories and metadata from the device’s file system.
Depending on the device and method, it may include application databases, configuration files, caches and system information that a simpler logical extraction doesn’t expose.
That gives the examiner more opportunity to inspect source files and run additional parsers.
But encryption and permissions still matter.
A file may be acquired while its content remains encrypted or unsupported.
The term full file system is often a product description of broad file-system access. It doesn’t mean every physical storage cell or every cloud item connected to the device has been acquired.
A physical extraction traditionally means obtaining a lower-level copy or image of device memory rather than asking only for logical files.
NIST describes the distinction as the logical view presented through operating-system structures compared with a rawer physical view of storage.
A physical method may provide opportunities to examine unallocated areas, data remnants and material outside the active file system.
But modern mobile devices use hardware-backed encryption, flash translation, secure processors and other controls.
A physical image may be encrypted, partial, limited to particular partitions or difficult to decode.
The label physical doesn’t guarantee useful deleted data or a readable copy of everything on the phone.
The terminology can also vary.
One vendor may describe a method as advanced logical, another as file system, and another by the exploit or backup method used.
The same label can produce different results across device models, operating-system versions and lock states.
So don’t rank reports by name alone.
Ask what the method actually acquired.
Which partitions, containers, files or application areas were obtained?
Was the device unlocked?
Was the data decrypted?
Were any areas inaccessible?
Was a separate memory card, SIM, backup or cloud source acquired?
Did the tool verify successful completion?
The common mistake is:
“It was physical, so it contains everything.”
It may contain a broader and lower-level dataset.
It may still be incomplete, encrypted or only partly decoded.
Another mistake is:
“It was only logical, so the evidence is weak.”
A logical extraction may reliably obtain the exact active records needed for the investigation.
The acquisition level affects opportunity and limitation.
It doesn’t decide evidential value by itself.
Use the method label as the start of the question.
Then ask what was actually obtained, what was readable and what the forensic software successfully interpreted.
Key takeaway
A broader extraction can create more opportunities for analysis, but no label guarantees that every area was acquired, decrypted or successfully decoded.
Related questions¶
- How do I find out what data was actually extracted?
- Does the report contain everything that was on the phone?
- Why might two reports from the same device contain different information?
Source notes¶
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- SWGDE Best Practices for Mobile Device Evidence Collection, Preservation, Handling and Acquisition
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST Computer Forensics Tool Testing: Mobile Devices