Learning Android Forensics - Second Edition

Root access

When forensically analyzing an Android device, the limiting factor is often not the type of data being sought, but rather whether or not the examiner has the ability to access the data. Root access has been covered extensively in Chapter 2, Setting Up the Android Forensic Environment, but it is important enough to warrant repetition. All of the data listed previously, when stored on the internal flash memory, is protected and requires root access to read. The exception to this is application data that is stored on the SD card, which will be discussed later in this book.

Without root access, a forensic examiner cannot simply copy information from the /data partition. The examiner will have to find some method of escalating privileges ...