Practical Mobile Forensics - Fourth Edition

Pseudo filesystems

Pseudo filesystems, as the name suggests, are not actual files but a logical grouping of files. The following are some of the important pseudo filesystems in Android:

• The root filesystem (rootfs) is one of the main components of Android and contains all the information required to boot the device. When the device starts the boot process, it needs access to many core files, and thus, it mounts the root filesystem. As shown in the preceding mount command-line output, this filesystem is mounted at / (root folder). Hence, this is the filesystem on which all the other filesystems are slowly mounted. If this filesystem is corrupt, the device cannot be booted.
• The sysfs filesystem mounts the /sys folder, which contains information ...