Computer Forensics Lab, e-discovery.uk
e‑discovery.uk
Computer Forensics Lab eDiscovery
§ Guide

Android Acquisition Logical File System And Physical

The acquisition method chosen for an Android device determines the scope of evidence available for legal proceedings.

Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active

Guide · 17 pages · 25 min read · Published 2026-09-02

Designed for UK legal practitioners navigating mobile evidence, this resource addresses the critical reality that an Android acquisition method directly dictates what a court ultimately sees. Digital evidence relies on three distinct depths of extraction: logical extractions, which only obtain data handed over by the device; file-system extractions, which reach internal storage and application databases containing deleted data; and physical extractions, which capture raw memory. By explaining how hardware and operating system constraints determine technical feasibility, the text provides solicitors and barristers with the framework needed to evaluate forensic reports, verify integrity records, and challenge silent or incomplete evidence. It maps out complementary evidence sources, including Google account backups, while outlining practical deployment strategies, interrogatories for opponents or e-discovery providers, and common technical limitations. Through practical worked examples, procedural checklists, and red flags, the material equips legal teams to instruct digital forensic experts effectively, draft precise instructions, and ensure that shallow extractions do not obscure critical facts in legal proceedings.

Share
LinkedIn X / Twitter WhatsApp Email

Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.

§ Credit and source

Published by Computer Forensics Lab on 2026-09-02. Original material of the practice, free to read, cite and download. The authority behind this subject is ACPO/NPCC Good Practice Guide for Digital Evidence, which you should read alongside this guide. See every guide's author and source.

§ Read Android Acquisition Logical File System And Physical

Download the PDF

Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.

Android Acquisition Logical File System And Physical

ANDROIDACQUISITION · A GUIDE FOR UK LAWYERS Android Acquisition: Logical, File System and Physical Three Depths of Extraction, and Why the Method Chosen Decides What the Court Will Ever See COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the method decides the evidence 03 The three depths and what each reaches 04 How the device decides which is possible 05 Integrity, verification and the record of method 06 Reading a report in the light of its method 07 Deployment: choosing, obtaining and defending the depth 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: on Android the acquisition method decides the evidence, a logical extraction takes only what the device hands over, a file-system extraction reaches the storage and app databases including deleted not degree, so the depth must be asked about for every device and every report.

§ 02 · FIRST PRINCIPLES The problem in plain English: the method decides the evidence

§ 03 · THETHREEDEPTHS The three depths and what each reaches LOGICAL FILE SYSTEM PHYSICAL DELETED DATA VERIFIED

§ 04 · WHATTHEDEVICEDECIDES How the device decides which is possible

§ 05 · INTEGRITY AND METHOD Integrity, verification and the record of method

§ 06 · READINGAREPORT Reading a report in the light of its method

§ 07 · DEPLOYMENT Deployment: choosing, obtaining and defending the depth

§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ACCOUNT / LOGICAL FILE-SYSTEM PHYSICAL COUNTERPART / EXTRACTION EXTRACTION EXTRACTION PROVIDER GOOGLE BACKUPS

§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEREPORTTHATWASSILENTABOUTWHATITCOULDNOTSEE EXAMPLE2 · THEDEVICEWHOSECEILINGWASLOW, ANDTHEESTATETHATWASNOT EXAMPLE3 · THEMETHODTHATWASRECORDED, ANDTHECHALLENGETHATFAILED

§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations

§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROID AC QUISITION

§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android acquisition checklist Red flags When to involve a digital forensic expert

§ 13 · COMMON QUESTIONS Frequently asked questions What is the difference between logical, file-system and physical extraction? Why does the acquisition method matter so much for the evidence? Can the examiner just choose the deepest method? The other side's report says nothing was found. Should we accept that? How is an extraction made defensible? What if the device only permits a shallow extraction?

§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER

§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY

§ Related documents
Instruct the practice

Bring us in early. Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

Open a confidential matter→+44 (0)20 7164 6971Direct lineinfo@e-discovery.ukEncrypted
WhatsApp