With the emergence of mobile device access in day-to-day human activities, there is a huge increase in misuse for criminal purposes. During mobile forensics, extracting the data from the different storage capabilities of the mobile devices is essential. Mobile devices can store information in three main sources: internal memory, removable storage, and online data storage. In mobile forensics, either a certain amount of relevant data extraction is important, or full extraction of the device is important to investigate the crime event.
   During mobile forensics, the evidence extraction involves identifying the volatile memory data, temporary files, key management system, and metadata for encryption. The forensic examiners extract the original data further to facilitate the criminal investigation on the mobile device. All the mobile forensic investigation procedures intend to extract the potential evidence alone to increase the evidence admissibility in the court.
   The design of the mobile operating systems and type of the mobile devices complicates the mobile evidence extraction with the traditional forensic procedures. By examining the obfuscated data stored in the mobile device, the forensic investigators precisely extract the evidence by adapting effective data extraction methods for the customized mobile devices.