Mobile device extraction levels describe how deeply an examiner reaches into a phone to get data. The widely used framework from NIST, with an added level commonly used today, runs from least to most invasive: manual extraction (reading the screen), logical extraction (asking the phone’s operating system for its data), file system extraction (copying the phone’s stored files and app databases), physical extraction (imaging the raw memory), chip-off (removing the memory chip and reading it directly) and micro read (examining the memory cells under a microscope). Each step down can recover more, but takes more skill, time and risk to the device and to the evidence.
Examiners commonly begin with the least invasive method that can answer the investigative question and move deeper only when it cannot.
Key takeaways
- Levels trade depth of data against risk, time and skill
- Manual and logical extraction are fast but see only what the phone chooses to show
- File system extraction is where most useful app data sits on modern smartphones
- Physical extraction can reach deleted data, but encryption limits it on newer devices
- Chip-off is destructive and increasingly ineffective against encrypted phones
- Micro read is a specialist, rarely used technique
- The extraction level used should be recorded in the report, along with the hash values
- Cloud data is a separate legal and technical path, not an extraction level
Why extraction levels matter
A phone in an investigation is rarely one question. It might be “who did this person call last Tuesday?”, “was this WhatsApp chat deleted?” or “where was this device at 11 pm?” Different questions need different depth.
Choosing the right level matters for four reasons.
- Evidence quality. The deeper methods carry more risk of changing the device if done carelessly.
- Completeness. A method that cannot see deleted messages or app databases may leave the key evidence untouched.
- Time and cost. A logical extraction can take minutes. A chip-off can take days and needs a specialist lab.
- Admissibility. In India, electronic evidence is typically presented with a certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which includes hash values. The method used should be clear and repeatable. Our guide to the Section 63 BSA certificate covers this in detail.
The levels at a glance
| Level | How it works | What it can recover | What it usually misses | Risk to device | Skill and time |
|---|---|---|---|---|---|
| 1. Manual | Examiner operates the phone and photographs or records the screen | Only what is visible on screen | Deleted items, hidden data, anything not displayed | Moderate: accidental changes, new notifications overwrite state | Low skill, slow for large data |
| 2. Logical | Software requests data from the phone through its operating system | Contacts, calls, SMS, media, installed apps, some app data | Most deleted data, protected app data | Low | Low to moderate, fast |
| 3. File system | Copies the phone’s file structure, including app databases | App chats, location caches, browser data, system logs, some deleted records in databases | Raw unallocated space | Low to moderate | Moderate |
| 4. Physical | Creates a bit-by-bit image of the phone’s flash memory, often through bootloader or test access | Everything in logical and file system, plus deleted data in unallocated space where recoverable | Data protected by hardware-bound encryption | Moderate | High, device dependent |
| 5. Chip-off | Memory chip is removed from the board and read directly | Raw memory image, bypassing the phone’s software | Content that remains encrypted without the key | High: destructive | Very high, days |
| 6. Micro read | Memory cells examined under an electron microscope | Theoretically raw physical data | Practically very limited and rarely attempted | Extreme | Specialist, rarely seen |
Level 1: Manual extraction
What it is
The examiner uses the phone’s own screen and buttons to browse data, and photographs or screen-records what is found.
When it helps
A quick triage at the scene. A device that cannot be connected to a tool. Confirming what a user sees, such as a specific chat or an app notification.
Limits
Only visible data is captured. Deleted items stay hidden. Every tap can alter the phone, for example by marking a message as read, so a careful examiner records every step. It is also slow and error-prone for large volumes.
Level 2: Logical extraction
What it is
A forensic tool connects to the phone, asks its operating system for data through an official interface or backup mechanism, and stores what the phone hands over.
What it typically gives
Contacts, call logs, SMS and messages in standard stores, photos and videos, calendar entries, installed app lists and some app data.
Limits
The phone decides what to share. Protected app data is often not included, and deleted material is largely out of reach. On modern devices, what a logical method can reach depends heavily on the operating system version and security settings.
When it helps
Quick, low-risk and good for first-pass triage in high-volume cases. Many agencies use it as the first step in routine cases.
Level 3: File system extraction
What it is
A copy of the phone’s file structure, including the databases that apps use to store their data.
Why it matters
On modern smartphones, most of what an investigation needs lives in app databases: chats, call histories, location caches, browsing records, and system logs that show app usage and device activity. Databases can also hold records that the app has marked deleted but not yet overwritten, which a skilled examiner may be able to recover.
Limits
It does not usually reach raw unallocated space. Its success depends on the device model, operating system version and lock state, and on whether the device is unlocked or its security can be handled lawfully.
Level 4: Physical extraction
What it is
A bit-by-bit copy of the phone’s flash memory, rather than only the files the operating system presents. NIST describes this family under “hex dumping” and JTAG, where the examiner uses the bootloader or test access points on the circuit board to read memory.
What it can add
Deleted data in unallocated space, fragments of old files and structures that logical and file system methods never see.
Limits
On many current smartphones, data is encrypted with keys tied to the device’s hardware and the user’s passcode. A raw image of encrypted memory without the key is largely unreadable. Physical access has therefore become less productive on newer devices, though still valuable on older handsets and some low-cost models.
Level 5: Chip-off
What it is
The memory chip is physically removed from the circuit board and read with specialised equipment.
When it has been used
Damaged, locked or non-responsive older phones where no software route works.
Limits
It destroys the device’s original working state, needs a specialist lab, can fail if the chip is damaged in removal, and is of limited use where data is encrypted with hardware-bound keys. It is generally a last resort and is usually discussed with the legal team beforehand because it is irreversible.
Level 6: Micro read
What it is
Examining the physical memory cells under an electron microscope and interpreting their state.
How examiners commonly choose a level
There is no single correct route, but many teams work through the same questions.
| Question | Why it matters |
|---|---|
| What is the investigative question? | Call records need less depth than a deleted-chat recovery |
| What is the device and OS version? | Support for each level varies sharply by model and software version |
| Is the device on, off, locked or unlocked? | A powered-on, unlocked device gives options that are lost if it locks or restarts |
| Is it connected to a network? | Remote wipe or new data arriving can alter evidence, so isolation steps are often taken |
| What does the legal authority cover? | Scope of the seizure order or search should match what is extracted |
| Is the evidence time-critical? | Fast triage first, deeper work later |
| What are the consequences of failure? | Irreversible methods such as chip-off warrant extra caution |
A commonly followed principle is to start with the least invasive method likely to answer the question, validate it, and escalate only if needed.
Beyond the device: cloud data
Much of what a user does on a phone lives in cloud services: backups, messages synced across devices, photos, location history and email. This is not an extraction level. It is a separate acquisition path that generally depends on legal process directed at the service provider, or lawful access to the user’s authenticated account. Teams commonly treat it as a parallel workstream with its own authority, records and verification.
Handling the seizure well
What happens before extraction affects what can be extracted.
- Record the state at the scene: On or off, locked or unlocked, battery level, visible notifications, network connections. Photograph the device. Recording the search and seizure through audio-video, as BNSS Section 105 provides, supports this.
- Protect against remote changes: Teams often use signal isolation methods and keep the device powered where appropriate, because a restart can lock a device that was previously accessible.
- Capture credentials lawfully: Whether a suspect can be required to disclose a passcode or provide biometrics is a legally sensitive area. It is best handled through the investigating officer and legal advice, in line with Article 20(3) and current case law.
- Maintain the chain of custody from seizure to lab to court. See our guide on chain of custody for digital evidence under BNSS.
Documenting the extraction
Whatever the level, a defensible extraction record usually captures:
| Item | Why |
|---|---|
| Device make, model, serial number, IMEI | Identifies the exhibit |
| OS version and security patch level | Explains what was and was not accessible |
| Lock state and how access was obtained | Shows the extraction was lawful and methodical |
| Extraction level and method used | Lets another examiner repeat or challenge the work |
| Tool name and version | Results can differ by version |
| Date, time and examiner | Accountability |
| Hash values of the extracted image | Proves the data has not changed |
| Items not extracted and why | Honest scope |
These details feed directly into the Section 63 BSA certificate and any expert testimony.
Privacy and proportionality
A phone holds far more than the evidence an investigation needs: family photos, health information, financial details and messages of third parties who have nothing to do with the case. Teams increasingly use scoped extraction and targeted search of the extracted data to look at what is relevant to the case.
Handling of personal data should follow the applicable law, including the Digital Personal Data Protection Act, 2023 and its Rules, and the department’s own policy.
Common misunderstandings
- “Physical is always better than logical.” Not necessarily. On encrypted modern devices, a file system extraction may yield more readable data than a physical image.
- “Deleted means gone, or deleted means always recoverable.” Neither is true. It depends on the data type, the device and how much time has passed.
- “The tool extracts everything.” Tool support varies by device and OS version, and no tool covers every phone.
- “One extraction is enough.” Many teams validate with a second method or re-run to confirm the results.
- “Cloud data is on the phone.” Often it is not, and it needs a separate lawful route.
Frequently asked questions
1. What are the levels of mobile phone extraction?
The common levels are manual, logical, file system, physical, chip-off and micro read. The NIST framework covers manual, logical, hex dumping and JTAG (physical), chip-off and micro read, and practitioners commonly add file system extraction between logical and physical.
2. What is the difference between logical and physical extraction?
Logical extraction asks the phone’s operating system for data and gets what the phone chooses to provide. Physical extraction copies the raw flash memory, which can include deleted data that the operating system no longer shows, subject to encryption.
3. Can deleted WhatsApp messages be recovered?
Sometimes. Recovery depends on the device, how the app stores data, how much time has passed and whether the data remains in app databases or unallocated memory. File system and physical methods give the best chances, but nothing is guaranteed.
4. Is chip-off still used?
It is used rarely, mainly on damaged or older devices. On modern phones with hardware-based encryption, reading the chip directly often produces data that cannot be decrypted without the keys.
5. Which extraction level is best?
There is no universal best. The right level depends on the investigative question, the device, its security state and the legal authority. Many teams start with the least invasive method that can answer the question.
6. Does the extraction level affect admissibility in Indian courts?
The level itself is not the test, but the method should be documented, repeatable and supported by hash values and the Section 63 BSA certificate. A clear record of what was extracted, how and by whom strengthens the evidence.
7. Is cloud data part of mobile extraction?
No. Cloud data is a separate acquisition path that generally relies on legal process directed at the service provider or authorised access to the account.
