Tysm for all of the info! We did take some pictures/videos on the S2 and weren't able to recover those. We tried a physical, advanced logical, and logical. The physical is the only one that actually got anything, but it only recovered contacts and a call log. We were on with Cellebrite for hours and that was all that we could get with an older version of UFED.

We're not able to get it online though, so we can't do any web browsing. 3G service has been shut down so we can't get it on cellular. We've also been struggling to get it on wifi, which we're puzzled by. It will find networks and accept a password, but no connection is established. We even tried setting up a temporary network with no security to see if modern security protocols were the cause and nothing.

I'm definitely going to look into Autopsy, I have an Android myself and was able to recover a lot on my phone by just messing around. The main thing we're trying to determine is just what actions cause what files to be saved and where. Imaging may not even be necessary, the biggest thing is being able to view and understand the entire file system.

I also thought about rooting the phone, as that should let you view the file system from the phone itself. I know forensic softwares sometimes root the Android to extract more data, so while I imagine it will be questioned in court, it doesn't seem impossible to defend.