Book Image

Practical Mobile Forensics - Third Edition

By : Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Book Image

Practical Mobile Forensics - Third Edition

By: Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty

Overview of this book

Covering up-to-date mobile platforms, this book will focuses on teaching you the most recent techniques for investigating mobile devices. We delve mobile forensics techniques in iOS 9-11, Android 7-8 devices, and Windows 10. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from the cloud, and document and prepare reports of your investigations. By the end of this book, you will have mastered the current operating systems and the relevant techniques to recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Title Page
Copyright and Credits
Packt Upsell
Contributors
Preface
5
iOS Data Analysis and Recovery

The Android file system


Understanding the file system is one essential part of forensic methodologies. Knowledge about properties and the structure of a file system proves to be useful during forensic analysis. The file system refers to the way data is stored, organized, and retrieved from a volume. A basic installation may be based on one volume split into several partitions; here, each partition can be managed by a different file system. As is true in Linux, Android utilizes mount points and not drives (that is, C: or E:). Each file system defines its own rules for managing the files in the volume. Depending on these rules, each file system offers a different speed for file retrieval, security, size, and so on. Linux uses several file systems, and so does Android. From a forensic point of view, it's important to understand which file systems are used by Android and to identify the file systems that are of significance to the investigation. For example, the file system that stores the user...