Android Forensics

Chapter 4

Android file systems and data structures

Information in this chapter

• Data in the shell

• Type of memory

• File systems

• Mounted file systems and directory structures

Introduction

While the underlying hardware and software powering Android devices is fascinating, the primary focus of forensic analysts and security engineers is to acquire, analyze, and understand data stored on a device. Like other topics discussed, there are many nuances to this that are important to understand for effective analysis including what types of data are stored, where they are stored, how they are stored, and characteristics of the physical mediums on which they are stored. All of these factors play a major role in what data can be recovered and how ...