Physical acquisition strikes the best balance between extraction speed, ease of use, and the amount of information being extracted. This process does not require disassembling the phone or using any special hardware. A micro USB (or Apple Lightning) cord, a PC (or Mac), and forensic software for physical acquisition (refer to the following section) are all that's required. For iOS devices newer than iPhone 4, Elcomsoft iOS Forensic Toolkit is currently the only physical acquisition solution available.
Physical acquisition extracts the maximum amount of information from the device. For unencrypted devices, unallocated space will be extracted together with the filesystem, allowing experts to carve the dump for destroyed evidence. Encrypted devices handle unallocated space differently. For example, Apple iOS always uses full-disk encryption that does not keep encryption keys to released data blocks. As a result, unallocated areas can be accessed, but cannot be decrypted...