You need to image the device and then decrypt the image if it is encrypted and pick through the files. There are various programs on line such as Pandora Box hex dump. Unless you know what you are doing, it is not a straightforward task as a lot of it is carried out by Forensic services that will keep a lot of this under wraps for professional reasons.
