In this chapter, we learned various techniques to recover deleted data from an Android device. This process depends on various factors, which heavily rely on access to the data residing in the internal memory and SD card. We saw various techniques to recover deleted data from both SD card as well as internal memory. While the recovery of deleted items from external storage, such as an SD card, is easy, the recovery of deleted items from the internal memory takes considerable effort. We have also learned SQLite file-parsing and file-carving techniques, using which deleted data can be extracted from an Android device. With this knowledge, you can now perform data recovery during a forensic investigation.
The next chapter discusses the forensic analysis of Android apps and malware and the reverse engineering of Android apps.