Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Analyzing an Android image
The term Android image refers to the physical image (also called forensic image or raw image) that is obtained by performing any of the physical data extraction techniques. Using the techniques explained in Chapter 9, Android Data Extraction Techniques, you can image the entire /data/data block, or any particular block that is of relevance to the investigation. Once the image is obtained, an investigator can manually go through the contents of the file or take advantage of the available tools to parse through the contents. Commercial tools, such as Cellebrite, XRY, and so on, can drill into the data and present a comprehensive picture of the contents. Autopsy is one of the very widely used open source tools in the ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access