# Cyber Crime Investigation: Landscape, Challenges, and Future Research Directions
## 2 Digital Forensics
### Mobile Forensics
#### 2.2.2 Data Extraction  
There are common collection methods, also called data extraction, used in mobile forensics. Data from mobile devices must be extracted during investigations. There are five levels of data extraction: manual, logical, hex dumps, chip-offs, and micro reads [5]. Each of these options allow investigators to gather different information from different areas of the device with varying levels of complexity. Table 1 shows a comparison of these methods based on the criteria described in Section 1.  
Manual extractions have the lowest complexity because this is where investigators interact with the device using normal methods, such as the touch screen. However, this method can be risky because investigators could accidentally damage or modify the data on the device. It is not advised to use this method because it puts the evidence at risk of destruction or modification, which could make the evidence unusable in the case if it went to court.  
Logical extraction is where investigators will extract data from the device to an external workstation using technology such as Bluetooth or a USB. This method also has a risk of inadvertent data modification. Logical extraction is a good method to begin with during an investigation because it allows investigators to analyze data from a different device. It is worth noting that with logical extraction, a pin or password may be required to access the data, which could cause legal issues or complications.  
Hex dumps require specialized tools to download the device's flash memory and allows investigators to access data remnants. It is a good way to read and analyze bits of data that may be residing between larger files. This method, however, can be difficult  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Method** & **Complexity** & **Risk** & **Notes** \\ \hline
**Manual Extraction** & Low Complexity & High Risk & Puts the integrity of the data at risk of accidental tampering \\
**Logical Extraction** & Low Complexity & Low Risk & Utilizes an external workstation \\
**Hex Dumps** & Medium Complexity & Low Risk & Analyzes dumps of flash memory on an external device \\
**Chip-offs** & High Complexity & Medium Risk & Physically removes the flash memory \\
**Micro Reads** & High Complexity & High Risk & A last resort option because it is very complex and time consuming \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of the methods of mobile data extraction [5].  
Figure 1: Mobile forensic investigative phases [3].  
because it requires investigators to parse memory, which can be challenging and requires specialized training.  
Chip-offs are where investigators physically remove flash memory and create a binary image of it that can help in traditional analysis. However, it presents the danger of physical damage to the device, making it medium risk. This is less advised than hex dumps because, as with manual extractions, this puts the evidence at risk of destruction or modification.  
Finally, micro reads are the most complicated method out of these five. They use electron microscopes to analyze the logic gates in order to determine the readable data. This method is considered a \"last resort\" method because it is challenging and resource exhaustive. Micro reads are not applicable to many case scenarios because of their challenging nature.  
As shown in Table 1, manual extraction, although easy to perform, is the least recommended because of the risk it poses to the data's integrity. The best methods are logical extraction and hex dumps. These analyze information from different places, so they give investigators a method of gathering different evidence that the other method does not access. Logical extraction and hex dumps have medium or low complexity, making them faster and more efficient to use. Finally, both of these methods pose a low risk to data integrity because they utilize a separate workstation for data manipulation.