Learning Android Forensics - Second Edition

Connecting and accessing Android devices from the workstation

In order to extract information from an Android device, it first needs to be connected to the workstation. As mentioned earlier, care should be taken to make sure that the workstation is forensically sterile and used only for the purpose of investigation. A forensically sterile workstation is one that has a proper build and is free from malware. So, if you are familiar with virtual machines and snapshots, it may be a good idea for mobile forensics in general and Android forensics in particular, as you can have a perfectly clean workstation every time you need to examine a new device.

When a device is connected to the computer, changes can be made to the device, and so it is crucial ...