forensic analysis android windows os x 2017

Many of the techniques used in traditional forensic investigations are applicable in Android forensics analysis.

This technique, which relies on the Content Providers built into the Android platform and software development kit (SDK), is effective in producing some important forensic data, but only a fraction of the data that are available on the system.Īndrew Hoog, in Android Forensics, 2011 Publisher Summary In Android forensics, the most common logical technique does not provide direct access to the file system and operates at a more abstract and less-effective level than the traditional logical techniques, which can acquire all nondeleted data directly from the file system. Also, the physical techniques are more difficult to execute and missteps could leave the device inaccessible. Of course, the analysis of an Android physical acquisition is generally far more difficult and time consuming. As physical forensic techniques provide direct access to the storage medium, it is possible to recover both the allocated and the unallocated (deleted or obsolete) data. As discussed in Chapter 4, file systems often only mark data as deleted or obsolete, and do not actually erase the storage medium unless needed. There are advantages to this approach the most significant is that physical techniques likely provide access to significant amounts of deleted data.

Physical techniques, on the other hand, target the physical storage medium directly and do not rely on the file system itself to access the data. While recovery of the deleted data requires special tools and techniques, it is possible to recover deleted data from a logical acquisition.

One exception to this definition is that some files, such as an SQLite database, can be allocated and still contain deleted records in the database. Allocated data simply means that the data are not deleted and are accessible on the file system. A logical technique extracts allocated data and is typically achieved by accessing the file system. Andrew Hoog, in Android Forensics, 2011 Difference Between Logical and Physical TechniquesĪndroid forensic techniques are either logical or physical in nature.

Forensic analysis android windows os x 2017