Android Forensics

Abstract

Mobile devices are among the most common new technologies of the latest years, gaining even more spread and success in the day-to-day life of people. Smartphones gather all these features to meet several of the wishes of the people and as time runs, they will reach a point to replace personal computers. Smartphones in general are perhaps the one electronic device that knows the most about an individual. For most people, their smartphone is rarely more than a few meters from them at any point of time. This device blends both personal and corporate information and has the ability to store vast amounts of data including text messages, e-mails, GPS locations, picture, videos, and more. Clearly there is a need for forensics. Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. While the number of mobile devices are used in crime activities is spreading and growing all over the world, the capability to perform the forensics analysis of such devices is limited both by technological and methodological problems. Both mobile forensics and Android forensics in particular have a set of challenges that must be overcome. Criminals could use the smartphones for committing fraud over e-mail, harassment through text messages, trafficking of illegal material, communications related to drugs, etc. The data stored on smart phones could be extremely useful to analysts through the course of an investigation. A fundamental goal in digital forensics is to prevent any modification of the target device by the examiner. The project encompasses all the elements of the Android internals, the data types, the partitions and directories alongside with the procedures of imaging them. The Android concepts and components are analyzed showing the reason that these are necessary for the forensic procedure. The practical part contains the analysis of the device divided in logical and physical examination. This project presents a standardized procedure that covers a large part of device forensics trying to give some serious forensic material.