Practical Mobile Forensics - Third Edition

Recovering deleted data from an external SD card

Data present on SD cards can reveal a lot of information to forensic investigators. SD cards are capable of storing pictures and videos taken by the phone's camera, voice recordings, application data, cached files, and more. Essentially, anything that can be stored on a computer hard drive can be stored on an SD card as much as the available space allows.

Recovering the deleted data from an external SD card is a straightforward process. SD cards can be mounted as an external mass storage device and forensically acquired using standard digital forensic methods, as discussed in Chapter 9, Android Data Extraction Techniques. As mentioned in the previous chapters, SD cards in Android devices often ...