Imaging a device is one of the most important steps in mobile device forensics. The rule of thumb when dealing with a forensic examination is to ensure that the data present on the device is not modified in any way, wherever possible. As explained in Chapter 1, Introduction to Mobile Forensics, all the changes by the examiner from the previous testing and validation should be well documented. When possible, it's imperative to obtain a physical image of the Android device before performing any techniques to extract the data directly from the device. In forensics, this process of obtaining a physical or logical acquisition is commonly called imaging the device. A physical image is preferred as it is a bit-by-bit copy of the Android device memory.

It is important to understand that a bit-by-bit image is not similar to copying and pasting the contents on the device. If we copy and paste the contents on a device it will only copy the available files such as visible files...