Practical Mobile Forensics - Fourth Edition

The Android filesystem

Understanding the filesystem is one essential part of forensic methodologies. Knowledge about the properties and the structure of a filesystem proves to be useful during forensic analysis. The filesystem refers to the way data is stored, organized, and retrieved from a volume. A basic installation may be based on one volume split into several partitions; here, each partition can be managed by a different filesystem. As is true in Linux, Android utilizes mount points, and not drives (that is, C: or E:).

In Linux, mounting is an act of attaching an additional filesystem to the currently accessible filesystem of a computer. The filesystems in Linux are not accessed by drive names but instead are organized into a multi-level ...