Logical extraction
Acquisition through the operating system and supported interfaces, including contacts, messages, media and backups. Only data accessible to the selected method is read.
IT expert witness · mobile device analysis
MOBILedit Forensic ULTRA.
Mobile data extraction, verification and reporting
MOBILedit Forensic ULTRA supports acquisition and analysis of data from compatible mobile devices. Work may cover communications, apps, files, metadata and activity timelines. Analysis considers sources, consistency and extraction limitations; results are presented in a report or IT expert assessment.
Enquire about device analysisFrom device to examination material
Phone data extraction methods
The method depends on the model, operating system, security patches and device condition. The acquisition scope is recorded in the examination documentation.
File system and full file system
Examination of directories, application databases and configuration files. Broader access to protected areas requires a supported method and appropriate permissions. This is not the same as a physical memory image.
Physical extraction
A binary image of memory or its partitions, available for supported devices. MOBILedit describes methods involving MTK chipsets and EDL mode. Encryption can still limit access after imaging.
For iPhone, I distinguish backups, available logical data and imported file system extractions. MOBILedit does not support physical extraction of iOS devices. No method guarantees recovery of all deleted data.
Documentation that makes results verifiable
The material description, sequence of actions, tool version, method and hashes of captured files make the examination traceable. Interpretation considers source databases, metadata, time zones and consistency. Tool output is distinguished from expert conclusions.
Manufacturer documentation: logical extraction · file system · physical extraction. Checked on 13 October 2026.
Capabilities and methods
Scope of mobile device data analysis
The method and scope are assessed for each device. Acquired material requires verification, correlation and interpretation.
Device-specific extraction
Logical extraction copies data exposed by the system. Compatible Android devices may also allow physical imaging and advanced ULTRA methods. Selection depends on the model, system version and security state.
Conversations, files and app data
Analysis may cover call logs, SMS, contacts, photographs, recordings and supported app data. Conversations and attachments are read in their source context; availability depends on the app version and extracted material.
Traces of deleted data
Deleting a record does not always immediately remove every trace. Surviving fragments may remain in application databases or caches. Results depend on overwriting, encryption and device behaviour.
Timelines and data relationships
Timestamped events can be arranged into a timeline. Filtering by period, contact or content helps identify relevant material; interpretation accounts for each record’s origin and limitations.
Backups and material for re-examination
Available backups and supported extraction files can be analysed again. Where sufficiently complete, they allow additional questions to be examined without accessing the phone again.
Reporting and documenting findings
MOBILedit supports PDF, HTML and XLS reports and data exports. Tool reports are treated as analysis material: I present relevant findings, identify sources and explain the limits of the available information.
Compatibility and security
Matching the method to the device and its security
The exact model, system version, device condition and security patch level affect data acquisition. ULTRA adds methods for supported devices; capabilities vary considerably between models.
Even a full memory image may contain encrypted or inaccessible information. The report explains both findings and limitations relevant to their assessment.
Compatibility in manufacturer documentation ↗Mobile analysis questions
Technical conditions and assignment scope
Can a locked phone be analysed?
Sometimes. MOBILedit Forensic ULTRA offers advanced methods for compatible devices, but access depends on the model, chipset, system and security. Each phone is assessed individually.
Can you recover deleted messages?
Some surviving traces may be recovered if they remain in accessible databases or memory. Recovery cannot be guaranteed in advance; overwriting and encryption are important factors.
Does analysis cover WhatsApp, Signal or Telegram?
It may cover supported messaging apps where their data is accessible to the chosen acquisition method. Support changes; I assess the system, app version and surviving material.
How do logical and physical extraction differ?
Logical extraction copies data made accessible by the device. Physical extraction creates a memory image of a supported device and may broaden the material. A full image does not automatically unlock encrypted data.
What should I prepare before contacting you?
Provide the model, device condition and purpose of analysis. State whether you have the phone or a backup. Share passwords and sensitive details only through an agreed channel.
What will I receive when the work is complete?
Deliverables are agreed before work begins. They may include relevant data and events, a report and an explanation of findings, methods and limitations.
Enquiries and assignments
Contact about an analysis or expert opinion
I welcome courts, police and prosecutors. Prompt deadlines are agreed after assessing the material and scope. Please describe the assignment, available devices or data, and questions for the opinion.
ul. Kielecka 2/53, 31-526 Kraków · Rondo Mogilskie
Assignments across Poland · meetings by appointment
View location on the map ↗
Map and distances to Kraków courts
Details for an initial assessment
Describe the device or medium, the issue and the questions to be answered. Details of available data copies will help establish the scope.
Prepare an enquiryWe will agree the material transfer and deadline individually.