Practical Mobile Forensics - Third Edition

Imaging an Android phone

Imaging a device is one of the most important steps in mobile device forensics. When possible, it's imperative to obtain a physical image of the Android device before performing any techniques to extract the data directly from the device. In forensics, this process of obtaining a physical acquisition is commonly called imaging the device. The terms physical image, forensic image, or raw image are often used to refer to the image captured through this process. Let's first revisit how imaging is done on a desktop computer as it helps us to correlate and realize the problems associated with imaging Android devices. Let's assume that a desktop computer, which is not powered on, is seized from a suspect and sent for forensic ...