Practical Mobile Forensics - Third Edition

The Android file system

Understanding the file system is one essential part of forensic methodologies. Knowledge about properties and the structure of a file system proves to be useful during forensic analysis. The file system refers to the way data is stored, organized, and retrieved from a volume. A basic installation may be based on one volume split into several partitions; here, each partition can be managed by a different file system. As is true in Linux, Android utilizes mount points and not drives (that is, C: or E:). Each file system defines its own rules for managing the files in the volume. Depending on these rules, each file system offers a different speed for file retrieval, security, size, and so on. Linux uses several file systems, ...