Full-file system vs. File system

The terms "file system" and "full-file system" refer to different types of data extraction from a mobile device.

1. File System Extraction: This refers to accessing and copying the files and directories as they are organized in the device's file system. It typically includes visible data like documents, photos, videos, and application data. However, this method does not typically access deleted files or fragments of data that are not part of active files in the file system. The file system extraction is often quicker and less invasive, but it doesn't provide as comprehensive a view of the data as a full-file system extraction.

2. Full-File System Extraction: This goes a step beyond basic file system extraction. It involves accessing the complete file system, including areas that are not usually accessible during normal device operation. This type of extraction can retrieve deleted files, hidden files, and system logs, offering a much more comprehensive view of the data on the device. It's a deeper form of data extraction that can be crucial for forensic investigations, as it can uncover evidence that wouldn't be visible through a standard file system extraction.

When using MOBILedit Forensic it can be considered in the following way:

• Logical extraction = File system

• Root access/Jailbroken device = Full-file system

In summary, while a file system extraction provides access to the active and visible parts of a device's storage, a full-file system extraction dives deeper, accessing deleted and hidden data, which can be critical in forensic analyses. The choice between these two methods depends on the requirements of the investigation and the level of access available to the forensic examiner.

Android file system overview:

In Android, the root of the file system refers to the top-most directory of the file hierarchy, denoted by a single forward slash (/). The Android file system is based on the Linux file system structure and includes several important directories. Here is an overview of the key directories typically found at the root level of an Android file system:

1. /system:

   • Contains the core Android OS files, including system binaries, libraries, and default applications. It's usually mounted as read-only.

2. /data:

   • Stores user data and app data. This is where installed apps store their data and settings. It's unique to each device and user, and it's typically mounted as read-write.

3. /cache:

   • Used for storing frequently accessed data and app cache to improve performance. It helps speed up access to data and reduces the need to fetch it from the source repeatedly.

4. /sdcard or /storage/emulated/0:

   • Represents the internal and external storage accessible to the user. It's where media files like photos, videos, and downloads are stored.

5. /mnt:

   • Contains mount points for file systems that are mounted. This includes external storage and other file systems.

6. /vendor:

   • Contains hardware-specific libraries and binaries provided by the device manufacturer. It's used for device-specific customizations and drivers.

7. /boot:

   • Contains the bootloader and kernel, essential for the device's startup process.

8. /recovery:

   • Contains files necessary for the recovery mode, which can be used for system repair and maintenance tasks.

9. /proc:

   • A virtual file system that contains runtime system information, such as system memory, CPU information, and process details.

10. /dev:

    • Contains device nodes, which are interfaces to the device's hardware components.

11. /sys:

    • Another virtual file system that provides information about the system's hardware and allows for interaction with kernel components.

12. /etc:

    • Contains system-wide configuration files.

iOS file system overview

Here's an overview of the root and full file system structure for iOS, which is based on a Unix-like system derived from macOS. The structure includes several key directories:

1. /Applications:

   • Contains system and user-installed applications. Each app is stored in its own directory within this path.

2. /var:

   • A directory for variable data, such as logs, databases, and temporary files. This is often the location for app data.

3. /System:

   • Contains the core operating system files, including system binaries, libraries, and frameworks essential for the OS to function.

4. /private:

   • A symbolic link that points to the /var directory. It contains app data, logs, temporary files, and other variable data.

5. /Library:

   • Contains system-wide libraries and configuration files, as well as some app data.

6. /usr:

   • Contains user binaries, libraries, documentation, and other shared resources.

7. /bin:

   • Contains essential command binaries that are needed in single-user mode and for basic system operation.

8. /sbin:

   • Contains system binaries that are essential for system administration tasks.

9. /etc:

   • Contains configuration files and system-wide settings.

10. /dev:

    • Contains device nodes, which are interfaces to the device's hardware components.

11. /tmp:

    • A directory for temporary files. Files here are typically deleted upon system reboot.

12. /var/mobile:

    • Contains user-specific data, such as documents, application data, and settings for the user with ID mobile.

13. /Developer:

    • Contains development tools and resources, used primarily when the device is in development mode.