Android Forensics

Android Architecture Overview

Android is an open-source mobile operating system based on a modified Linux kernel. Understanding its layered architecture is essential for effective forensic analysis. Each layer provides different access points and data sources for investigators.

Security Model

Android implements a multi-layered security model that directly impacts forensic acquisition:

• Application Sandboxing: Each app runs in its own Linux user context with unique UID
• SELinux: Mandatory Access Control (MAC) restricting even root-level access
• Verified Boot: Ensures device boots only authorized software
• Full Disk Encryption (FDE): Encrypts entire /data partition (Android 5.0+)
• File-Based Encryption (FBE): Encrypts individual files with different keys (Android 7.0+)
• TrustZone: Hardware-isolated secure world for cryptographic operations

Android File System Structure

Android devices typically use ext4 or F2FS file systems for internal storage. Understanding the partition layout and directory structure is crucial for targeted evidence collection.

Primary Partitions

Key Directory Structure

Application Data Locations

Each Android application stores data in specific locations based on the data type and sensitivity. Understanding these locations is essential for targeted evidence collection.

Private App Data

Located at /data/data/[package_name]/, this directory is accessible only to the app (without root):

/data/data/com.example.app/
    databases/    # SQLite databases - Primary data storage
    shared_prefs/ # XML preference files - Settings, tokens
    files/        # App-specific files
    cache/        # Temporary cached data
    lib/          # Native libraries
    no_backup/    # Data excluded from backups

Key Application Data Locations

Android Debug Bridge (ADB)

ADB is a versatile command-line tool that enables communication with Android devices. For forensics, it provides a critical interface for logical acquisition and device examination.

Essential ADB Commands for Forensics

# Check connected devices
adb devices -l
List of devices attached
XXXXXXXXX       device usb:1-1 product:device model:Pixel_6

# Get device information
adb shell getprop ro.product.model
adb shell getprop ro.build.version.release
adb shell getprop ro.serialno

# Check root status
adb shell su -c "id"

# Create full backup (requires user confirmation on device)
adb backup -apk -shared -all -f full_backup.ab

# Pull specific files/directories
adb pull /sdcard/DCIM/ ./extracted_photos/
adb pull /sdcard/Download/ ./extracted_downloads/

# Pull app data (requires root)
adb shell su -c "cp /data/data/com.whatsapp/databases/msgstore.db /sdcard/"
adb pull /sdcard/msgstore.db

# List installed packages
adb shell pm list packages -f

# Get package information
adb shell dumpsys package com.whatsapp

# Dump call log (requires permissions)
adb shell content query --uri content://call_log/calls

# Dump SMS messages
adb shell content query --uri content://sms

# Get contacts
adb shell content query --uri content://contacts/phones

# Capture screenshot
adb shell screencap /sdcard/screen.png
adb pull /sdcard/screen.png

# Record screen (Android 4.4+)
adb shell screenrecord /sdcard/recording.mp4

# Get system logs (for activity analysis)
adb logcat -d > device_logs.txt

# Dump bug report (comprehensive system state)
adb bugreport > bugreport.zip

Logical Extraction Methods

Logical extraction retrieves data through the Android operating system using standard APIs and interfaces. While less comprehensive than physical extraction, it's faster and works on more devices.

ADB Backup Method

Content Provider Extraction

Android Content Providers expose structured data through URIs. This method can retrieve contacts, SMS, call logs, and calendar data without root access:

# SMS Messages
content://sms
content://sms/inbox
content://sms/sent

# Call Log
content://call_log/calls

# Contacts
content://contacts/phones
content://com.android.contacts/contacts

# Calendar
content://calendar/events

# Browser Bookmarks (legacy)
content://browser/bookmarks

Physical Extraction Methods

Physical extraction creates a bit-by-bit image of the device storage, capturing all data including deleted files and unallocated space. This requires elevated access.

Root-Based Physical Extraction

If the device is rooted or can be temporarily rooted, the following methods are available:

# Identify partitions
adb shell su -c "ls -la /dev/block/by-name/"

# Create image of userdata partition
adb shell su -c "dd if=/dev/block/by-name/userdata of=/sdcard/userdata.img bs=4096"

# Pull the image
adb pull /sdcard/userdata.img

# Alternative: Stream directly to workstation (faster)
adb shell su -c "dd if=/dev/block/by-name/userdata bs=4096" > userdata.img

# Calculate hash for integrity
sha256sum userdata.img

Advanced Physical Methods

Key Forensic Artifacts

SQLite Databases

Most Android data is stored in SQLite databases. Key databases to examine:

Other Important Artifacts

• Shared Preferences (XML): App settings, authentication tokens, user preferences
• accounts.db: Google and other account information
• wifi/WifiConfigStore.xml: Saved WiFi networks with SSIDs (and sometimes passwords)
• bluetooth/: Paired device information
• Thumbnails: .thumbdata files may contain thumbnails of deleted images
• Recents: Recent apps and activities