Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Learning Android Forensics
  • Toc
  • feedback
Learning Android Forensics

Learning Android Forensics

By : Oleg Skulkin, Tindall, Rohit Tamma
2 (2)
close
Learning Android Forensics

Learning Android Forensics

2 (2)
By: Oleg Skulkin, Tindall, Rohit Tamma

Overview of this book

Many forensic examiners rely on commercial, push-button tools to retrieve and analyze data, even though there is no tool that does either of these jobs perfectly. Learning Android Forensics will introduce you to the most up-to-date Android platform and its architecture, and provide a high-level overview of what Android forensics entails. You will understand how data is stored on Android devices and how to set up a digital forensic examination environment. As you make your way through the chapters, you will work through various physical and logical techniques to extract data from devices in order to obtain forensic evidence. You will also learn how to recover deleted data and forensically analyze application data with the help of various open source and commercial tools. In the concluding chapters, you will explore malware analysis so that you’ll be able to investigate cybersecurity incidents involving Android malware. By the end of this book, you will have a complete understanding of the Android forensic process, you will have explored open source and commercial forensic tools, and will have basic skills of Android malware identification and analysis.
Table of Contents (12 chapters)
close

Android partition layout

Partitions are logical storage units made inside the device's persistent storage memory. Partitioning allows you to logically divide the available space into sections that can be accessed independently of one another.

Common partitions in Android

The partition layout varies between vendors and versions, but a few partitions are present in all Android devices. The following are some of the common partitions found in most Android devices:

  • BOOT: As the name suggests, this partition has the information and files required for the phone to boot. It contains the kernel and the RAMDisk and so, without this partition, the phone can't start its processes.
  • CACHE: This partition is used to store frequently...
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete