Full file system-- and what this is,
I showed you on the middle screenshot here.
We could see that we have a ZIP file.
I wanted to show you what all of the data is going to look like.
So we can see in the data, we have 28,238 files.
Analyzed Data over here, this is just a continuation
that I had to cut off from the slide.
So we can see we have a lot of information.
We are going to start looking for deleted artifacts.
So here, we can see there were 345 messages.
Seven were deleted.
We have web searches, 3,004, 37 of which are deleted.
Some deleted things will be recoverable
if the tool supports it and if the database has not
been vacuumed yet.
You are going to start uncovering deleted data
from these devices.
I'm going to show you some free scripts that can do it too.
When we look at full file system,
the issue is newer versions of Android-- specifically,
Android 12--
may prohibit certain access.
Getting a full file system acquisition
is really going to help you.
Again, make sure you look at your extraction
because you may find, when you do full file system,
it may not provide the serial number of the device, the phone
number of the device, all those basic identifiers
that we covered in Section 1.
If you get full file system, we also
recommend getting an advanced logical.