Utilize forensic utilities to mount the files system and present files of interest. In the event that none of the files in your file system are parsed, you may have to manually carve for those items that you expect to find on the device. This is where you should become familiar with the types of files and their respective file headers on each of these devices.

Tools like Cellebrite Physical Analyzer and Magnet’s Axiom will do a very good job of carving a mobile device acquisition for image files; however, depending on device support, you may have to separately carve for additional items of interest. Depending on the tool you are using, you may want to initiate additional carves for HEIC/HEIF files and KTX files from iOS devices.

Because the bulk of user data on smartphones is stored in SQLite files, you should be very familiar with the 16-byte SQLite format 3 database header of 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00.

Not all devices utilize SQLite format 3. Some older operating systems utilize proprietary or non-SQLite databases, so keep this in mind for carving. Carving for known byte signatures across the device image will help to isolate files of possible interest. It is important that you know what type of files are most commonly used on the operating system you are analyzing in order to make sure you have recovered all possible data.