This chapter covered various manual, logical, and physical data extraction techniques. We learned when and how to apply these techniques during the course of an investigation. Logical techniques extract data by interacting with the device using tools such as ADB. Physical techniques, on the other hand, access a larger set of data; they are complex and require a great deal of expertise to perform. Imaging a device produces a bit-by-bit image of the device, which is later analyzed using tools. Imaging a device is one of the primary steps to ensure that the data on the device is not modified. Android 7.0 and above poses a new challenge to forensic investigators by bringing in new security features and file paths that may limit acquisition. With this knowledge, you can perform device acquisition to extract relevant data from an Android device.
In the next chapter, we will...