Phone Extraction Co...
 
Notifications
Clear all

Phone Extraction Comparison

3 Posts
3 Users
1 Likes
2,243 Views
(@staypuff)
Posts: 1
New Member
Topic starter
 

Has anyone done a test to compare a phone extraction with UFED4PC and then after several new versions of UFED4PC conduct an extraction of the same phone (in the same state ie unused during this time) to see if the extraction pulled more data. 

 
Posted : 27/07/2022 6:51 pm
4n6Matt
(@4n6matt)
Posts: 4
New Member
 

Yes ! 

 

I have seen where advancements in the forensics tools have later decoded further data. This is not uncommon. We capture screenshots so we can compare datasets between date and software versions. 

 

There is often no need to conduct a further extraction of the handset, just decode the data extraction you have stored as evidence again. 

 
Posted : 09/08/2022 1:24 pm
 DO_G
(@do_g)
Posts: 4
Active Member
 

It always depends on which kind of extraction you have. 

  • Physical or FFS: There shouldn't be a change with an update.
  • Logical or filesystem: There can be a change.

The analyses later changes nearly with every update.

 
Posted : 14/09/2022 9:21 am
dega reacted
Share: