The adb pull command can be used to pull single files or entire directories directly from the device to the forensic examiner's computer. This method is especially useful for small, targeted examinations. For example, in an investigation strictly involving SMS messages, the examiner can choose to pull just the relevant files, if possible.
Manual ADB data extraction
USB Debugging
Setting up the ADB environment has been previously discussed in this book. However, the device under examination must also be configured properly. USB Debugging is the actual method through which the examiner's computer will communicate with the device. USB Debugging is found under the Developer Options in the Settings menu. However, as of...