Logical analysis involves connecting the mobile device to forensic hardware or to a forensic workstation via a USB cable, an RJ-45 cable, infrared, or Bluetooth. Once connected, the computer initiates a command and sends it to the device, which is then interpreted by the device's processor. Next, the requested data is received from the device's memory and sent back to the forensic workstation. Later, you can review the data.

Most of the forensic tools currently available work at this level of the classification system. The extraction process is fast and easy to use and requires little training for you. On the flip side, the process may write data to the mobile and might change the integrity of the evidence. In addition, deleted data is not generally accessible with this procedure.