Understanding the file system is one essential part of forensic methodologies. Knowledge about properties and the structure of a file system proves to be useful during forensic analysis. File system refers to the way data is stored, organized, and retrieved from a volume. A basic installation may be based on one volume split into several partitions; here each partition can be managed by a different file system. As is true in Linux, Android utilizes mount points and not drives (that is C:
or E:
). Each file system defines its own rules for managing the files on the volume. Depending on these rules, each file system offers a different speed for file retrieval, security, size, and so on. Linux uses several file systems, and so does Android. From a forensic point of view, it's important to understand what file systems are used by Android and to identify the file systems that are of significance to the investigation. For example, the file system that stores the user's data...
Practical Mobile Forensics
Practical Mobile Forensics
Overview of this book
Table of Contents (20 chapters)
Practical Mobile Forensics
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Free Chapter
Introduction to Mobile Forensics
Understanding the Internals of iOS Devices
Data Acquisition from iOS Devices
Data Acquisition from iOS Backups
iOS Data Analysis and Recovery
iOS Forensic Tools
Understanding Android
Android Forensic Setup and Pre Data Extraction Techniques
Android Data Extraction Techniques
Android Data Recovery Techniques
Android App Analysis and Overview of Forensic Tools
Windows Phone Forensics
BlackBerry Forensics
Index
Customer Reviews