Learning Android Forensics - Second Edition

ADB on a rooted device

We have already seen how the ADB tool can be used to interact with the device and execute certain commands on the device. However, on a normal Android phone, certain locations such as /data/data cannot be accessed. For example, the following shows the command-line output when trying to access /data/data on a normal device:

adb shellshell@android:/ $ cd /data/datacd /data/datashell@android:/data/data $ lsls: .: Permission denied

This is because the private data of all of the applications is stored in this folder and so the security is enforced by the Android. Only the root user has access to this location. Hence, on a rooted device, you will be able to see all of the data under this location, as shown in the following ...