In the previous chapter, we covered various logical and physical extraction techniques. In physical extraction, a bit-by-bit image of the Android device is obtained, which contains valuable information. In this chapter, we will learn how to analyze and extract relevant data, such as call logs, text messages, and so on, from an image file. While the data extraction and analysis techniques provide information about various details, not all techniques can provide information about the deleted data. Data recovery is a crucial aspect of mobile forensics, as it helps to unearth the deleted items. This chapter aims at covering various techniques, which can be used by a forensic analyst to recover the data from an Android device.
In this chapter, we will cover the following two major topics:
Analyzing and extracting data from Android image files using the open source tool, Autopsy
Various techniques to recover deleted files from the SD card and internal...