Practical Mobile Forensics - Third Edition

Summary

Recovery of the deleted data on Android devices depends on various factors, which heavily rely on access to the data residing in the internal memory and SD card. While the recovery of deleted items from external storage, such as an SD card, is easy, the recovery of deleted items from the internal memory takes considerable effort. SQLite file-parsing and file-carving techniques are two methods that are used to recover deleted data extracted from an Android device.

The next chapter discusses forensic analysis of Android apps, malware, and the reverse engineering of Android apps.