Learning Android Forensics - Second Edition

Using adb shell to determine if a device is rooted

The simplest method to determine if a device is rooted is to use adb shell. This will open a shell on the device that will be accessed on the examiner's computer; this means that any commands run in the shell will be executed on the device. Once USB Debugging is enabled and Secure USB Debugging is bypassed (or from Recovery Mode, as discussed later), open a Terminal on the local computer and run the following:

adb shell

The shell will appear in one of two ways, either with $ or #:

On Linux systems, # is used to indicate a root user; $ indicates a non-root user. If the shell returns showing ...