Practical Mobile Forensics - Third Edition

Analyzing an Android image

The term Android image refers to the physical image (also called forensic image or raw image) that is obtained by performing any of the physical data extraction techniques. Using the techniques explained in Chapter 9, Android Data Extraction Techniques, you can image the entire /data/data block, or any particular block that is of relevance to the investigation. Once the image is obtained, an investigator can manually go through the contents of the file or take advantage of the available tools to parse through the contents. Commercial tools, such as Cellebrite, XRY, and so on, can drill into the data and present a comprehensive picture of the contents. Autopsy is one of the very widely used open source tools in the ...