The terms "file system" and "full-file system" refer to different types of data extraction from a mobile device.
File System Extraction: This refers to accessing and copying the files and directories as they are organized in the device's file system. It typically includes visible data like documents, photos, videos, and application data. However, this method does not typically access deleted files or fragments of data that are not part of active files in the file system. The file system extraction is often quicker and less invasive, but it doesn't provide as comprehensive a view of the data as a full-file system extraction.
Full-File System Extraction: This goes a step beyond basic file system extraction. It involves accessing the complete file system, including areas that are not usually accessible during normal device operation. This type of extraction can retrieve deleted files, hidden files, and system logs, offering a much more comprehensive view of the data on the device. It's a deeper form of data extraction that can be crucial for forensic investigations, as it can uncover evidence that wouldn't be visible through a standard file system extraction.
When using MOBILedit Forensic it can be considered in the following way:
Logical extraction = File system
Root access/Jailbroken device = Full-file system
In summary, while a file system extraction provides access to the active and visible parts of a device's storage, a full-file system extraction dives deeper, accessing deleted and hidden data, which can be critical in forensic analyses. The choice between these two methods depends on the requirements of the investigation and the level of access available to the forensic examiner.