Learning Android Forensics

Android file hierarchy

In order to perform forensic analysis on any system (desktop or mobile), it's important to understand the underlying file hierarchy. A basic understanding of how Android organizes its data in files and folders helps a forensic analyst narrow down his research to specific locations. If you are familiar with Unix-like systems, you will understand the file hierarchy in Android very well. In Linux, the file hierarchy is a single tree, with the top of the tree being denoted as /. This is called the root. This is different from the concept of organizing files in drives (as with Windows). Whether the filesystem is local or remote, it will be present under the root. Android file hierarchy is a customized version of this existing ...