Join us for the next installment of the SANS-APAC webcast series where we will provide a technical look at Mobile Device Forensics.
If you're only doing a logical analysis then you have to consider that you are in all probability really only getting part of the evidence that may in fact exist. Simply put, a thorough analysis requires a physical extraction and its more complete examination.
As an example, in a physical acquisition and analysis of an iPhone the additional evidence recovered included:
1000+ audio files
60+ chats (included Facebook and Skype)
3300+ text files
Performing anything less than a physical acquisition and analysis is simply not a through forensic examination!