Learning Android Forensics

Connecting and accessing an Android device from the workstation

In order to extract information from an Android device, it first needs to be connected to the workstation. As mentioned earlier, care should be taken to make sure that the workstation is forensically sterile and used only for the purpose of investigation. A forensically sterile workstation is one that has a proper build and is free from viruses and other malware. When a device is connected to the computer, changes can be made to the device. Hence, it is crucial that the forensic examiner maintains control over the device at all times. In the world of mobile forensics, using write-protection mechanisms may not be of great help, as they prevent successful acquisition of the device. ...