THE KEY POINTS
What to take with you.
- A backup or logical collection is not the same as a full file system extraction.
- Full collection describes MARA’s broader supported dataset; it does not mean a physical image or every byte of the phone.
- Targeted collection limits the delivered dataset to selected supported categories, with their required supporting files.
Ask what “phone imaging” means in this request.
Someone asking for remote phone imaging may mean a documented collection of messages and calls. Another team may be asking for a file system extraction. Those requests can sound similar while requiring different sources, methods, and deliverables.
Before choosing a tool or arranging the custodian’s appointment, identify the evidence question. Is the team looking for available conversations? A broader supported phone dataset? Files held within a particular app? A method-specific artifact? The request should describe the result needed, then confirm a collection approach that can address it.
Remote describes where the collection is coordinated. It does not, by itself, specify how data is acquired. The phone may stay with its custodian while the collection app runs on a connected computer. The acquisition method still needs to be understood separately.
Three terms that should not be interchangeable.
SWGDE’s mobile-device collection guidance distinguishes acquisition through the operating system from collection of the available file system. A practical comparison is:
| Term | What it describes | What to ask |
|---|---|---|
| Device backup | A backup made through a supported device or application workflow. | Which apps and artifacts are included in this backup? |
| Logical collection | Data requested through operating-system or application interfaces; backup utilities can be part of this approach. | Which supported sources does this collection obtain? |
| Full file system extraction | The available active files and folders across the file system. | Is this method available for the device, and what does it add for this matter? |
The acquisition label alone does not answer whether a specific conversation, attachment, or deleted record will be present. Establish the device and app coverage that matter to the request, and have the receiving team check the result against those needs.
An encrypted iPhone backup is still a backup.
Apple explains that encrypted computer backups can include additional information, such as call history, that an unencrypted backup does not. Encryption changes the backup’s protection and supported contents; it does not turn that backup into a full file system extraction.
Apple also publishes backup exclusions, including content already synced and stored in iCloud. It is therefore more useful to specify the desired source than to assume that “encrypted” or “full backup” means every category of phone and cloud data is included.
App coverage deserves its own question. Signal, for example, has its own backup and collection considerations. A familiar iPhone backup workflow should not be treated as a universal answer for every messaging app. See our Signal collection guide for that distinction.
Collection method and delivered scope are separate choices.
MARA offers a full collection or targeted iPhone collection. In that context, full collection means the broader supported dataset available through the collection workflow. It is not a claim of physical imaging, full file system acquisition, or access to every byte on the phone.
Targeted collection limits the delivered dataset to the selected supported categories, such as Calls, Messages, Contacts, or a combination, along with supporting files legitimately required for those artifacts. Your team can choose a narrower deliverable when that fits the matter.
That selection applies to categories. Current targeting does not select or exclude individual conversations or filter by date before acquisition. Those are separate review questions. The important distinction for counsel is what the team receives: a broader supported dataset or the agreed selected categories.
The broader supported dataset
Selected Calls, Messages, Contacts, and required supporting files
Five useful questions for the collection provider.
- Which source are we collecting? Identify the phone and relevant apps, rather than asking for “everything” without a defined need.
- Which method will be used? Ask what the collection obtains and how that relates to the evidence question.
- What scope will be delivered? Confirm broader supported data or selected categories.
- What accompanies the package? Establish the reports and documentation available to the receiving team.
- How will it be reviewed? Confirm the package can enter the intended review and export workflow.
These questions help forensic consulting teams compare tools, and help attorneys assign the collection without needing to operate those tools themselves. They also make it easier to identify a gap early, while the device and custodian are still available.
Choose the method for the evidence question.
More data is not automatically a more useful answer. A narrower supported collection may fit a messages-and-calls request; a different evidence question may call for another acquisition approach. Decide that from the matter’s needs and the actual device, not from the most expansive-sounding label.
MARA connects the agreed phone collection to secure portal delivery and Analyzer review. For teams running their own collections, Enterprise brings remote invitations, collection status, and deliverables into the team’s workspace. Start with a defined question and give the receiving team a collection it can understand and use.