"Get everything off the phone" is the most common instruction we receive from Australian legal teams — and the least precise. What an extraction yields depends on the handset, its OS version, its lock state, and the level of access the tooling can achieve.
Levels of Extraction
A logical extraction collects what the operating system offers up: contacts, call logs, messages, media. A full file system extraction goes deeper — application databases, cached locations, deleted-record fragments inside SQLite stores, keychain material. The difference is often the case: a Deleted WhatsApp Thread will rarely surface in a logical pull but frequently survives, in part, at the file-system level.
What the Data Can Establish
Recovered messages and their timestamps. Location artefacts — not just GPS fixes, but wifi join records, cell registrations and photo metadata that place a device in an area at a time. App usage and screen-unlock patterns. Whether a backup, wipe or mass deletion occurred, and when — often the decisive fact in employee-departure and preservation disputes.
What It Cannot Establish
A phone places a device, not a person — attribution needs corroboration. Content that lived only in the cloud, or in ephemeral apps configured to keep nothing, may never have been stored on the handset at all. And overwritten flash storage is genuinely gone: no tool recovers what the hardware has reclaimed. An honest report says so, which is exactly what makes the rest of it defensible under cross-examination.
The practical advice: preserve early, before the device cycles data or a custodian acts; and scope the extraction to the issues — proportionate, targeted collection reads far better in front of a judge than a fishing expedition.
Frequently Asked Questions
Can Deleted Messages Be Recovered from a Phone?
Often, at least in part. Deleted records can persist as fragments inside application databases at the file-system level until the storage is overwritten. What survives depends on the handset, its OS version and how much the device has been used since deletion — overwritten flash storage is genuinely unrecoverable.
Does a Phone Extraction Prove Who Sent a Message?
No. An extraction places a device, not a person — attribution needs corroboration, such as screen-unlock patterns, location artefacts or independent sources. An honest report states this limit, which is what makes its other findings defensible under cross-examination.
What Is the Difference Between a Logical and a Full File System Extraction?
A logical extraction collects what the operating system offers up: contacts, call logs, messages, media. A full file system extraction goes deeper — application databases, cached locations, deleted-record fragments and keychain material. Deleted content that never appears in a logical pull frequently survives, in part, at the file-system level.