Computer Forensics Lab, e-discovery.uk
e‑discovery.uk
Computer Forensics Lab eDiscovery
§ Guide

IOS Full File System Vs Logical Acquisition

iOS extractions differ in depth; this guide explains the distinction between logical and full-file-system acquisitions and why it matters.

Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active

Guide · 17 pages · 25 min read · Published 2026-09-02

Designed for UK legal practitioners navigating mobile device evidence, this reference addresses how extraction depth dictates the outcome of digital investigations. In litigation subject to CPR Part 35 expert reporting and full chain of custody requirements, choosing between logical acquisition and full-file-system acquisition fundamentally changes what evidence is uncovered or overlooked. A logical extraction gathers only what standard device interfaces hand over, whereas full-file-system extraction reaches deeper system files, including deleted records. Covering technical limitations, availability, and method choice, the material explores wider source architecture such as cloud repositories, computer backups, paired devices, and carrier records to ensure evidence is not missed when device-level depth is restricted. Practical guidance includes worked case examples, common procedural mistakes, red flags, and specific drafting aids for instructing e-discovery providers or questioning opponents about disclosed extraction methods. By establishing clear checklists and interrogatories, legal teams can accurately match forensic methods to specific matters, verify disclosure validity, and determine precisely when a digital forensic specialist must be instructed to secure vital evidence.

Share
LinkedIn X / Twitter WhatsApp Email

Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.

§ Credit and source

Published by Computer Forensics Lab on 2026-09-02. Original material of the practice, free to read, cite and download. The authority behind this subject is ACPO/NPCC Good Practice Guide for Digital Evidence, which you should read alongside this guide. See every guide's author and source.

§ Read IOS Full File System Vs Logical Acquisition

Download the PDF

Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.

Page 1

IOSACQUISITIONMETHODS · A GUIDE FOR UK LAWYERS iOS Full-File-System vs Logical Acquisition How Deep the Extraction Goes, and Why It Matters for What You Will Find COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM EXTRACTION-DEPTH ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: depth changes the answer 03 Logical acquisition: what the phone hands over 04 Full-file-system acquisition: the deeper record 05 What each reaches, and what it misses 06 Availability, method choice and honest limits 07 Deployment: matching the method to the matter 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: iOS extractions differ in depth, a logical acquisition collects what the phone hands over through normal interfaces, while a full-file-system acquisition reaches the deeper file system including far always be under stood and stated.

§ 02 · FIRST PRINCIPLES The problem in plain English: depth changes the answer

§ 03 · LOGICALACQUISITION Logical acquisition: what the phone hands over

Page 2

§ 04 · FULL - FILE - SYSTEM ACQUISITION Full-file-system acquisition: the deeper record

§ 05 · WHATEACHREACHES What each reaches, and what it misses

§ 06 · AVAILABILITYANDHONESTLIMITS Availability, method choice and honest limits

§ 07 · DEPLOYMENT Deployment: matching the method to the matter

§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SYSTEM I CLOUD LOGICAL COMPUTER PAIRED APP PROVIDER / (DEVICE) BACKUP MAC / IPAD CARRIER FULL-FILE- (DEVICE)

§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDMESSAGESALOGICALEXTRACTIONMISSED EXAMPLE2 · THELOGICALEXTRACTIONTHATWASENOUGH EXAMPLE3 · THEDEPTHTHATWASNOTAVAILABLE, ANDTHEESTATETHATHELPED

Page 3

§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations

§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOSE XT R AC TION

§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The extraction-depth checklist Red flags When to involve a digital forensic expert

§ 13 · COMMON QUESTIONS Frequently asked questions What is the difference between logical and full-file-system extraction? If a logical extraction found nothing, does that mean it isn't there? Do we always need the deeper extraction? Can you always do a full-file-system extraction? Why does the method used need to be disclosed? Can backups make up for a shallow device extraction?

§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER

§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY

§ Related documents
Instruct the practice

Bring us in early. Defensibility is built, not retrofitted.

Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.

Open a confidential matter→+44 (0)20 7164 6971Direct lineinfo@e-discovery.ukEncrypted
WhatsApp