Practical Mobile Forensics - Fourth Edition

Dalvik Virtual Machine (DVM)

All the applications that you install on the Android device are written in the Java programming language. When a Java program is compiled, we get bytecode. A virtual machine (VM) is an application that acts as an operating system—that is, it is possible to run an instance of the Windows operating system on a Mac, or vice versa, using a VM. Java Virtual Machine (JVM) is one such VM that can execute the previously mentioned bytecode. But Android versions before Android 5.0 used something called DVM to run their applications.

DVM runs Dalvik bytecode, which is Java bytecode converted by the Dalvik Executable (DEX) compiler. Thus, the .class files are converted to dex files using the dx tool. Dalvik bytecode, when ...