Understanding the underlying features, file systems, and capabilities of an Android device proves useful in a forensic investigation. Unlike iOS, several variants of Android exist as many devices run the Android operating system and each may have different file systems and unique features. The fact that Android is open and customizable also changes the playing field of digital forensics. A forensic examiner must be prepared to expect the unexpected when handling an Android device.
In the next chapter, we will discuss methods for accessing the data stored on Android devices.