Recovering deleted data from internal memory

Recovering files deleted from Android's internal memory, such as app data and so on, is not as easy as recovering such data from SD cards and SQLite databases, but, of course, it's not impossible. Many commercial forensic tools are capable of recovering deleted data from Android devices, of course, if physical acquisition is possible and the userdata partition isn't encrypted. But this is not very common for modern devices, especially those running most recent versions of the operating system, such as Oreo and Pie.

Most Android devices, especially modern smartphones and tablets, use the EXT4 file system to organize data in their internal storage. This file system is very common for Linux-based ...

Get Learning Android Forensics - Second Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.