Practical Mobile Forensics - Third Edition

Identifying Android malware

From a forensic perspective, it's important to identify the presence of any malware on the device prior to performing any analysis. This is because malware can alter the state of the device or contents on the device, thereby making the analysis or the results inconsistent. Information about various types of Android malware apps and their descriptions is provided at https://forensics.spreitzenbarth.de/android-malware/. There are tools available on the market that can analyze the physical extraction to identify malware. For example, Cellebrite UFED Physical Analyzer has BitDefender's anti-malware technology, which scans for malware. As shown in the following screenshot, once the physical image is loaded into the ...