Learning Android Forensics - Second Edition

Summary

Having sound knowledge of Android's partition layout, filesystems, and important locations would help the forensic investigator during the process of extracting data from the device. The userdata location on the Android device contains a bulk of user information that can be crucial for any forensic investigation. However, most of these files may be accessed only on a rooted phone (especially files present under the /data/data location). We have also seen Android data storage options, various filesystems used by Android, and their significance.

With this knowledge, we will now learn in the upcoming chapters about how to logically and physically extract data from an Android device.