According to the CHFI v11 Mobile Device Forensics objectives, physical acquisition of an Android device aims to obtain a bit-by-bit image of the device's storage, allowing investigators to recover deleted files, unallocated space, and hidden artifacts. When a device is rooted, investigators can leverage low-level Linux utilities such as the dd command to perform this acquisition.
The correct forensic procedure involves first connecting the Android device to the forensic workstation, typically via USB using ADB. The investigator must then obtain a root shell, as root privileges are mandatory to access raw block devices (for example, /dev/block/mmcblk0). Next, the investigator must identify the correct source (the physical partition or block device) and define the destination, which may be an external storage location or a streamed image file captured on the forensic workstation. Finally, the dd command is executed with precise input (if=) and output (of=) parameters to create a forensic image.