File-system acquisition is a forensic capture of a device’s files, folders, and related metadata for later analysis. Unlike a simple export of visible content, it aims to preserve the underlying directory structure, app databases, logs, caches, and configuration files that may hold evidence. On phones and computers, this kind of acquisition can reveal how data was stored and when it changed, which makes it valuable for timeline building and artifact correlation.
In cyber security, file-system acquisition matters because many important traces are not obvious to users. Investigators may use it after suspected compromise, data theft, policy abuse, or device loss to search for persistence artifacts, malicious app remnants, or signs of exfiltration. Defenders also rely on it for incident response and legal review, where a preserved copy can be parsed repeatedly without altering the original device. The quality of the acquisition depends on device state, permissions, and platform protections, so some artifacts may be incomplete or inaccessible.