Practical Mobile Forensics - Fourth Edition

Understanding data extraction techniques

Data residing on an Android device may be an integral part of civil, criminal, or internal investigations done as part of a corporate company's internal probe. While dealing with investigations involving Android devices, you, as the forensic examiner, need to be mindful of the issues that need to be taken care of during the forensic process; this includes determining whether root access is permitted (via consent or legal authority) and what data can be extracted and analyzed during the investigation. For example, in a criminal case involving stalking, the court may only allow SMS, call logs, and photos to be extracted and analyzed on the Android device belonging to the suspect. In this case, it may ...