# Physical acquisition

How it works?

* data is recovered in raw form.
  * copy bit by bit.
  * provides a lot of data, including deleted data (not overwritten).
  * requires decoding of the raw data.
    * CPU intensive.
    * software may not be able to decode everything.
    * cannot be done if device is encrypted.

What data can be retrieved in a physical acquisition?

<figure><img src="https://620581463-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNrxMTPBjxxzJFosGtQvH%2Fuploads%2FbXizTsZRSiUrVqWIEKPY%2Fa.png?alt=media&#x26;token=301c45ca-6e7a-4289-83dc-8074d245e04d" alt=""><figcaption></figcaption></figure>
