Learning Android Forensics - Second Edition

Android file hierarchy

In order to perform forensic analysis on any system (desktop or mobile), it's important to understand the underlying file hierarchy. Basic understanding of how Android organizes its data in files and folders helps a forensic analyst to narrow down his/her research to specific locations. If you are familiar with Unix-like systems, you'll understand the file hierarchy in Android very well. In Linux, the file hierarchy is a single tree with the top of the tree being denoted as /, called the root. This is different from the concept of organizing files in drives (as with Windows).

Whether the filesystem is local or remote, it will be present under the root. Android file hierarchy is a customized version of this existing ...