Mobile Forensics: Challenges in Non-Root Acquisition

Smartphones hold the richest evidence in most modern disputes: messages, call logs, photographs with location data, app databases and browsing history. Extracting that data in a way that survives cross-examination is harder than it looks, because the tools that give the deepest access are also the ones most likely to alter the device.

Three levels of acquisition

• Logical: the device exports data through documented interfaces such as the Android or iOS backup protocols. Nothing on the device is modified.
• File system: the examiner reads the file system directly, including app databases that a logical backup skips. This usually requires elevated privileges.
• Physical: a bit-for-bit copy of the storage chip, including deleted data. On modern encrypted phones this is frequently impossible without exploiting the device.

The problem with rooting and jailbreaking

Gaining root access means modifying the device's boot chain or operating system. From an evidentiary standpoint that is a change to the exhibit made by the examiner, before any evidence was captured. Opposing counsel will reasonably ask what else changed, and the honest answer is that nobody can be certain.

Rooting can also trip integrity checks that cause banking and messaging applications to wipe their local data, destroying exactly the artefacts the examiner came for. On several recent devices it disables secure-element features permanently.

How Evidify Creator approaches the problem

Evidify Creator performs a non-root acquisition using the device's own supported channels. On Android it combines the backup service, media transfer protocol access and app-level export where the application permits it. On iOS it uses the encrypted backup protocol, which exposes significantly more data than an unencrypted backup, including keychain-protected items such as saved Wi-Fi credentials and health data.

Hashing and custody from the first byte

Every artefact is hashed with SHA-256 as it leaves the device, and the acquisition log records the device identifier, operating system build, tool version, examiner and timestamps. The log itself is hashed, so the chain of custody begins before the examiner has looked at a single message.

Known limitations

• Applications that opt out of backup, such as some banking apps, are not captured by a logical acquisition.
• Deleted messages are generally not recoverable without file-system or physical access.
• Some manufacturer-specific Android builds restrict backup further, requiring app-by-app export.

Non-root acquisition is not a compromise; it is the method most consistent with the duty to preserve the exhibit as found. As operating systems tighten security further, it will increasingly be the only defensible choice.