Physical acquisition

How it works?

• data is recovered in raw form.

  • copy bit by bit.

  • provides a lot of data, including deleted data (not overwritten).

  • requires decoding of the raw data.

    • CPU intensive.

    • software may not be able to decode everything.

    • cannot be done if device is encrypted.

What data can be retrieved in a physical acquisition?