Learning Android Forensics - Second Edition

SD card security

In older versions of Android, simply plugging a phone into a computer would logically mount the SD card and allow an examiner access to its data. In one of the versions of Android (possibly 3.0), this changed, although the exact version could not be found in the various change logs we examined. Newer versions of Android will not automatically allow access to the SD card from a computer if a screen lock is in use, meaning that the screen lock will have to be bypassed in order to gain access to the SD card. The obvious exception to this is that a physical, external SD card can still be removed and analyzed with traditional computer forensic methods.

SD cards can also be encrypted, either through the device's full-disk encryption ...