Phone SeizedWhat is on your phoneWhat a phone extraction can actually see
What a phone extraction can actually see
What you must do, what you can refuse, and what they can do
Every claim below links to the source it comes from, with the wording quoted so you can check it yourself.
What the sources say
What a document, a report, an agency publication or a provision says, quoted as it is worded.
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says: “Logical: A process that requests file data from the operating system, which then interprets and returns the resultant data. Various techniques query the operating system in order to extract the data. These techniques can include, but are not limited to, backup utilities, application agents, and manual interaction. Manual interaction involves direct interaction with the device display to photograph/video/document data accessible via the user interface.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "Logical"
“Logical: A process that requests file data from the operating system, which then interprets and returns the resultant data. Various techniques query the operating system in order to extract the data. These techniques can include, but are not limited to, backup utilities, application agents, and manual interaction. Manual interaction involves direct interaction with the device display to photograph/video/document data accessible via the user interface.”
Read it at swgde.orgquote checked 2026-11-02
Upturn’s report “Mass Extraction” (20 Oct 2020) says: “Logical extraction automates what can be done through manual extraction. In other words, it automatically extracts data that’s presented on the phone to the user, using the device’s application programming interface (API). A logical extraction is like ordering food from a restaurant: what you can get is limited to menu items, and the waitstaff (the API) is in charge of their delivery and organization.”
Upturn, "Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones", 20 Oct 2020, "Extraction Methods"
“Logical extraction automates what can be done through manual extraction. In other words, it automatically extracts data that’s presented on the phone to the user, using the device’s application programming interface (API). A logical extraction is like ordering food from a restaurant: what you can get is limited to menu items, and the waitstaff (the API) is in charge of their delivery and organization.”
Read it at upturn.orgquote checked 2026-11-02
Upturn’s report “Mass Extraction” (20 Oct 2020) says: “File system extraction is similar to logical extraction, but it copies even more data — such as files or other data (like internal databases) that a phone doesn’t typically display to users. Continuing the restaurant analogy, this is akin to asking the chef for specific secret dishes outside of the menu, which is possible at some restaurants, but not others.”
Upturn, "Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones", 20 Oct 2020, "Extraction Methods"
“File system extraction is similar to logical extraction, but it copies even more data — such as files or other data (like internal databases) that a phone doesn’t typically display to users. Continuing the restaurant analogy, this is akin to asking the chef for specific secret dishes outside of the menu, which is possible at some restaurants, but not others.”
Read it at upturn.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says: “File System: A process that requests the active files and folders from the file system. This acquisition can contain remnants of deleted data and non-user data.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System"
“File System: A process that requests the active files and folders from the file system. This acquisition can contain remnants of deleted data and non-user data.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says, in its list after its File System definition (“File System acquisitions include:”): “Full File System (FFS): A complete collection of all available active files and folders.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "Full File System (FFS)"
“File System acquisitions include:—Full File System (FFS): A complete collection of all available active files and folders.”
Read it at swgde.orgquote checked 2026-11-02
Upturn’s report “Mass Extraction” (20 Oct 2020) says: “Physical extraction copies data as it’s physically stored on the phone’s hardware — in other words, copying data bit-by-bit, instead of as distinct files. This data has to be restructured into files for anyone to make sense of it. A physical extraction is like going to a restaurant and sneaking into the kitchen to take the food directly, as it exists in the kitchen — menu items that are waiting to be brought out, the ingredients used to prepare them, and even what’s in the trash — without mediation from the waitstaff.”
Upturn, "Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones", 20 Oct 2020, "Extraction Methods"
“Physical extraction copies data as it’s physically stored on the phone’s hardware — in other words, copying data bit-by-bit, instead of as distinct files. This data has to be restructured into files for anyone to make sense of it. A physical extraction is like going to a restaurant and sneaking into the kitchen to take the food directly, as it exists in the kitchen — menu items that are waiting to be brought out, the ingredients used to prepare them, and even what’s in the trash — without mediation from the waitstaff.”
Read it at upturn.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says: “Chip-Off: A destructive process that involves the removal and reading of a memory chip to conduct analysis.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "Physical" methods: "Chip-Off"
“Chip-Off: A destructive process that involves the removal and reading of a memory chip to conduct analysis.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says: “Physical: A process that extracts data via a direct connection to the device storage area. This includes Boot Loader, Chip-Off, In-system Programming (ISP), and Joint Test Action Group (JTAG) acquisitions. The resultant data from a device that utilizes File-Based Encryption (FBE) or Full-Disk Encryption (FDE) will be encrypted. At the time of publication, methodologies do not allow for decryption of FBE data. The ability to decrypt FDE data varies.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "Physical"
“Physical: A process that extracts data via a direct connection to the device storage area. This includes Boot Loader, Chip-Off, In-system Programming (ISP), and Joint Test Action Group (JTAG) acquisitions. The resultant data from a device that utilizes File—Based Encryption (FBE) or Full-Disk Encryption (FDE) will be encrypted. At the time of publication, methodologies do not allow for decryption of FBE data. The ability to decrypt FDE data varies.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says, in its list after its File System definition (“File System acquisitions include:”): “After First Unlock (AFU/Hot): A collection of available data from a powered-on device that has been unlocked at least once since the last operating system boot.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "After First Unlock (AFU/Hot)"
“File System acquisitions include:—After First Unlock (AFU/Hot): A collection of available data from a powered-on device that has been unlocked at least once since the last operating system boot.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says, in its list after its File System definition (“File System acquisitions include:”): “Before First Unlock (BFU/Cold): A collection of available data from a powered-on, locked device that has not been unlocked since the last operating system boot. This extraction contains a limited dataset when compared to AFU, Full File System, or Logical extractions.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "Before First Unlock (BFU/Cold)"
“File System acquisitions include:—Before First Unlock (BFU/Cold): A collection of available data from a powered—on, locked device that has not been unlocked since the last operating system boot. This extraction contains a limited dataset when compared to AFU, Full File System, or Logical extractions.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025), section 6, says, in its list after its File System definition (“File System acquisitions include:”): “Partial File System: A partial collection of active files and folders from the file system. Partial File System extractions include, but are not limited to, AFU and BFU.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "Partial File System"
“File System acquisitions include:—Partial File System: A partial collection of active files and folders from the file system. Partial File System extractions include, but are not limited to, AFU and BFU.”
Read it at swgde.orgquote checked 2026-11-02
Signal’s help article “Set and manage disappearing messages”, as fetched on 2 Nov 2026, says: “The message will disappear from your devices after the timer has elapsed. This is not for situations where your contact is your adversary — after all, if someone who receives a disappearing message really wants a record of it, they can always use another camera to take a photo of the screen before the message disappears.” It also says, under its question “What happens when the disappearing message timer reaches the end?”: “The message is deleted from disk.”
Signal Support, "Set and manage disappearing messages" (support.signal.org/hc/en-us/articles/360007320771), as fetched 2026-11-02
“The message will disappear from your—devices after the timer has elapsed. This is—not for situations where your contact is your adversary — after all, if someone who receives a disappearing message really wants a record of it, they can always use another camera to take a photo of the screen before the message disappears.—What happens when the disappearing message timer reaches the end? The message is deleted from—disk.”
Read it at support.signal.orgquote checked 2026-11-02
Signal’s blog, in a post dated 21 Apr 2021, said: “First off, anything involving Cellebrite starts with someone else physically holding your device in their hands. Cellebrite does not do any kind of data interception or remote surveillance.”
Signal blog (byline "moxie0"), "Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective", 21 Apr 2021
“First off, anything involving Cellebrite starts with someone else physically holding your device in their hands. Cellebrite does not do any kind of data interception or remote surveillance.”
Read it at signal.orgquote checked 2026-11-02
Signal’s blog, in a post dated 21 Apr 2021, said: “When Cellebrite announced that they added Signal support to their software, all it really meant was that they had added support to Physical Analyzer for the file formats used by Signal. This enables Physical Analyzer to display the Signal data that was extracted from an unlocked device in the Cellebrite user’s physical possession.”
Signal blog (byline "moxie0"), "Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective", 21 Apr 2021
“When Cellebrite announced that they added Signal support to their software, all it really meant was that they had added support to Physical Analyzer for the file formats used by Signal. This enables Physical Analyzer to display the Signal data that was extracted from an unlocked device in the Cellebrite user’s physical possession.”
Read it at signal.orgquote checked 2026-11-02
SQLite’s VACUUM documentation, as fetched on 2 Nov 2026, says: “When content is deleted from an SQLite database, the content is not usually erased but rather the space used to hold the content is marked as being available for reuse. This can allow deleted content to be recovered by a hacker or by forensic analysis. Running VACUUM will clean the database of all traces of deleted content, thus preventing an adversary from recovering deleted content.” The documentation is about SQLite databases in general.
SQLite, "VACUUM" (sqlite.org/lang_vacuum.html), section 2 "Description", as fetched 2026-11-02
“When content is deleted from an SQLite database, the content is not usually erased but rather the space used to hold the content is marked as being available for reuse. This can allow deleted content to be recovered by a hacker or by forensic analysis. Running VACUUM will clean the database of all traces of deleted content, thus preventing an adversary from recovering deleted content.”
Read it at sqlite.orgquote checked 2026-11-02
Cellebrite’s own UFED product page, in its section “What UFED Solves” (as fetched on 2 Nov 2026), says: “Modern devices default to encryption, and a growing share of the data investigators need -- messages, app data, deleted files -- sits behind it. Tools that only handle logical extraction leave that evidence out of reach.” This is Cellebrite’s marketing statement about its own product and about other tools.
Cellebrite, "Cellebrite UFED" product page (cellebrite.com/en/products/cellebrite-inseyets/ufed/), section "What UFED Solves" — Cellebrite's own marketing statement, as fetched 2026-11-02
“Modern devices default to encryption, and a growing share of the data investigators need -- messages, app data, deleted files -- sits behind it. Tools that only handle logical extraction leave that evidence out of reach.”
Read it at cellebrite.comquote checked 2026-11-02
MSAB’s own XRY product page (as fetched on 2 Nov 2026) says: “XRY Logical is the quickest extraction method as it enables you to access and recover live and file system data from the device right at the crime scene.” This is MSAB’s marketing statement about its own product.
MSAB, "XRY" product page (msab.com/product/xry-extract/), XRY Logical blurb — MSAB's own marketing statement, as fetched 2026-11-02
“XRY Logical is the quickest extraction method as it enables you to access and recover live and file system data from the device right at the crime scene.”
Read it at msab.comquote checked 2026-11-02
MSAB’s own XRY product page (as fetched on 2 Nov 2026) says: “XRY Physical lets examiners bypass the devices operating system to allow access to protected and deleted data; it also allows them to overcome certain security and encryption challenges on locked devices.” This is MSAB’s marketing statement about its own product.
MSAB, "XRY" product page (msab.com/product/xry-extract/), XRY Physical blurb — MSAB's own marketing statement, as fetched 2026-11-02
“XRY Physical lets examiners bypass the devices operating system to allow access to protected and deleted data; it also allows them to overcome certain security and encryption challenges on locked devices.”
Read it at msab.comquote checked 2026-11-02
Short answer
Short answer. In the sources quoted below, an extraction is a way of copying data from a phone. Upturn’s 2020 report likens a logical extraction to “ordering food from a restaurant: what you can get is limited to menu items”, a file system extraction to “asking the chef for specific secret dishes outside of the menu, which is possible at some restaurants, but not others”, and a physical extraction to “going to a restaurant and sneaking into the kitchen to take the food directly, as it exists in the kitchen”. SWGDE’s guidance (Version 2.0, 21 August 2025) defines the same three terms in its own words. Each source is dated where it is first quoted below. This page does not say which tool, phone model or software version any of it applies to.
The methods, in the sources’ own words
Logical. In plain words first, from a report. Upturn’s “Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones” (20 October 2020) says: “Logical extraction automates what can be done through manual extraction. In other words, it automatically extracts data that’s presented on the phone to the user, using the device’s application programming interface (API). A logical extraction is like ordering food from a restaurant: what you can get is limited to menu items, and the waitstaff (the API) is in charge of their delivery and organization.”
SWGDE (Version 2.0, 21 August 2025) defines it this way: “Logical: A process that requests file data from the operating system, which then interprets and returns the resultant data. Various techniques query the operating system in order to extract the data. These techniques can include, but are not limited to, backup utilities, application agents, and manual interaction. Manual interaction involves direct interaction with the device display to photograph/video/document data accessible via the user interface.”
File system. Upturn’s report continues: “File system extraction is similar to logical extraction, but it copies even more data — such as files or other data (like internal databases) that a phone doesn’t typically display to users. Continuing the restaurant analogy, this is akin to asking the chef for specific secret dishes outside of the menu, which is possible at some restaurants, but not others.”
SWGDE (Version 2.0, 21 August 2025) says: “File System: A process that requests the active files and folders from the file system. This acquisition can contain remnants of deleted data and non-user data.” SWGDE’s list after its File System definition (“File System acquisitions include:”) also includes a category called Full File System: “Full File System (FFS): A complete collection of all available active files and folders.”
Physical. Upturn describes it this way: “Physical extraction copies data as it’s physically stored on the phone’s hardware — in other words, copying data bit-by-bit, instead of as distinct files. This data has to be restructured into files for anyone to make sense of it. A physical extraction is like going to a restaurant and sneaking into the kitchen to take the food directly, as it exists in the kitchen — menu items that are waiting to be brought out, the ingredients used to prepare them, and even what’s in the trash — without mediation from the waitstaff.”
SWGDE (Version 2.0, 21 August 2025) begins its entry: “Physical: A process that extracts data via a direct connection to the device storage area.” Its next sentences, with the encryption sentences, are quoted in full in the next section. SWGDE’s list of physical methods includes one it defines this way: “Chip-Off: A destructive process that involves the removal and reading of a memory chip to conduct analysis.”
What the sources say about the phone’s state and encryption
Physical acquisition and encryption. SWGDE (Version 2.0, 21 August 2025) says, in the same entry: “Physical: A process that extracts data via a direct connection to the device storage area. This includes Boot Loader, Chip-Off, In-system Programming (ISP), and Joint Test Action Group (JTAG) acquisitions. The resultant data from a device that utilizes File-Based Encryption (FBE) or Full-Disk Encryption (FDE) will be encrypted. At the time of publication, methodologies do not allow for decryption of FBE data. The ability to decrypt FDE data varies.” The words “At the time of publication” open the sentence about FBE data, and the document is dated 21 August 2025. This page does not say whether anything has changed since 21 August 2025.
The phone’s state. This site’s own words for the state a phone is in are defined once, on What a full extraction contains, and are not redefined here. The next lines are SWGDE’s, in its own words.
SWGDE’s list (Version 2.0, 21 August 2025) after its File System definition (“File System acquisitions include:”) includes “After First Unlock (AFU/Hot): A collection of available data from a powered-on device that has been unlocked at least once since the last operating system boot.” The same list also includes “Before First Unlock (BFU/Cold): A collection of available data from a powered-on, locked device that has not been unlocked since the last operating system boot. This extraction contains a limited dataset when compared to AFU, Full File System, or Logical extractions.” The list also has a Partial File System entry: “Partial File System: A partial collection of active files and folders from the file system. Partial File System extractions include, but are not limited to, AFU and BFU.”
SWGDE’s AFU and BFU name collections of data; how they differ from this site’s four states is set out on What a full extraction contains.
Signal: what its own pages say, and what they do not say
Signal’s help article “Set and manage disappearing messages”, as fetched on 2 November 2026, says: “The message will disappear from your devices after the timer has elapsed. This is not for situations where your contact is your adversary — after all, if someone who receives a disappearing message really wants a record of it, they can always use another camera to take a photo of the screen before the message disappears.” The second sentence is about a contact who receives a disappearing message. Under its question “What happens when the disappearing message timer reaches the end?”, the same article says: “The message is deleted from disk.”
In a post dated 21 April 2021, Signal’s blog said: “First off, anything involving Cellebrite starts with someone else physically holding your device in their hands. Cellebrite does not do any kind of data interception or remote surveillance.” In the same post, Signal’s blog said: “When Cellebrite announced that they added Signal support to their software, all it really meant was that they had added support to Physical Analyzer for the file formats used by Signal. This enables Physical Analyzer to display the Signal data that was extracted from an unlocked device in the Cellebrite user’s physical possession.” That is Signal’s blog’s account on its date.
SQLite’s own VACUUM documentation, which is about SQLite databases in general, says (as fetched on 2 November 2026): “When content is deleted from an SQLite database, the content is not usually erased but rather the space used to hold the content is marked as being available for reuse. This can allow deleted content to be recovered by a hacker or by forensic analysis. Running VACUUM will clean the database of all traces of deleted content, thus preventing an adversary from recovering deleted content.”
Signal’s article says “The message is deleted from disk.” It does not say whether a deleted Signal message can or cannot be recovered, and none of the other passages quoted on this page says that about a Signal message either. The SQLite passage above is about SQLite databases in general. Nothing quoted here connects Signal’s sentences to SQLite’s.
What the toolmakers say about their own products
The sentences below come from toolmakers’ own product pages. Each is a company’s statement made in its own marketing. This page does not say that any product does what its maker says. Vendors’ product names do not necessarily match SWGDE’s or Upturn’s categories.
Cellebrite’s UFED product page, in its section “What UFED Solves”, as fetched on 2 November 2026, says, about encryption and about tools that only handle logical extraction: “Modern devices default to encryption, and a growing share of the data investigators need -- messages, app data, deleted files -- sits behind it. Tools that only handle logical extraction leave that evidence out of reach.”
MSAB’s XRY product page, as fetched on 2 November 2026, says of its products. Of XRY Logical: “XRY Logical is the quickest extraction method as it enables you to access and recover live and file system data from the device right at the crime scene.” Of XRY Physical: “XRY Physical lets examiners bypass the devices operating system to allow access to protected and deleted data; it also allows them to overcome certain security and encryption challenges on locked devices.” Those are MSAB’s words about its own products.
Our reading
This section is this site’s reading of the quotations above. It states no device fact and no legal fact; those stay in the quoted items. It is not advice, and this site does not endorse a product.
We would read the SWGDE sentences first, because they come from a guidance document, and Upturn’s report next, because it is a report with a date. We would read Signal’s blog, Signal’s help article and the SQLite documentation after them, each for what it says about itself. We would read the toolmakers’ sentences last, because each is a company describing its own product.
The quotations carry different dates: Upturn in October 2020, Signal’s blog in April 2021, SWGDE at its version date of 21 August 2025.
Nothing on this page is advice about what to do when a phone is sought or has been taken. For the statutes, guidance and court record on wipes and reboots, see Duress wipes, auto-reboot and the law.
Where to go next
- What a full extraction contains: where this site defines the words it uses for a phone’s state.
- Deleted is not gone: what its sources say about data the user has already deleted.
- Cloud and carrier: what its sources say about data held away from the phone.
- What Apple and Android’s own security notes say: the makers’ own dated notes, quoted.
- What can they actually get?: the question compared across jurisdictions.
- The could-they-get-in tool: what vendor and government documents say about each phone state.
- Lock state, Lockdown Mode and GrapheneOS: what each changes: vendor documents on lock state.
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.