An Introduction to Forensics Data Acquisition From Android Mobile Devices

The role that a Digital Forensics Investigator (DFI) is rife with continuous learning opportunities, especially as technology expands and proliferates into every corner of communications, entertainment and business. As a DFI, we deal with a daily onslaught of new devices. Many of these devices, like the cell phone or tablet, use common operating systems that we need to be familiar with. Certainly, the Android OS is predominant in the tablet and cell phone industry. Given the predominance of the Android OS in the mobile device market, DFIs will run into Android devices in the course of many investigations. While there are several models that suggest approaches to acquiring data from Android devices, this article introduces four viable methods that the DFI should consider when evidence gathering from Android devices.

A Bit of History of the Android OS

Android’s first commercial release was in September, 2008 with version 1.0. Android is the open source and ‘free to use’ operating system for mobile devices developed by Google. Importantly, early on, Google and other hardware companies formed the “Open Handset Alliance” (OHA) in 2007 to foster and support the growth of the Android in the marketplace. The OHA now consists of 84 hardware companies including giants like Samsung, HTC, and Motorola (to name a few). This alliance was established to compete with companies who had their own market offerings, such as competitive devices offered by Apple, Microsoft (Windows Phone 10 – which is now reportedly dead to the market), and Blackberry (which has ceased making hardware). Regardless if an OS is defunct or not, the DFI must know about the various versions of multiple operating system platforms, especially if their forensics focus is in a particular realm, such as mobile devices.

Linux and Android

The current iteration of the Android OS is based on Linux. Keep in mind that “based on Linux” does not mean the usual Linux apps will always run on an Android and, conversely, the Android apps that you might enjoy (or are familiar with) will not necessarily run on your Linux desktop. But Linux is not Android. To clarify the point, please note that Google selected the Linux kernel, the essential part of the Linux operating system, to manage the hardware chipset processing so that Google’s developers wouldn’t have to be concerned with the specifics of how processing occurs on a given set of hardware. This allows their developers to focus on the broader operating system layer and the user interface features of the Android OS.

Article Source: http://EzineArticles.com/9667830

Pin It

Leave a Reply

Your email address will not be published. Required fields are marked *