Chapter 3. Acquisition – Approaching Android Devices

Approximately, 82% of mobile devices (Q1, 2016) run the Android OS. The total number of active Android devices is about 1.4 billion (although not all of these are Google devices).

Similar to iOS, the data is not stored exclusively on mobile devices. In Android 6, Google officially introduced a cloud backup option, allowing users to maintain limited automatic backups for Android devices on Google Drive. Learning what Google knows about the user can be essential for an investigation.

An excellent resource with lots of detailed (but not too technical) information exists to help forensic experts get a better understanding of Android forensics. The Free Android Forensics blog at http://freeandroidforensics.blogspot.com offers excellent insight into the Android platform, imaging tools, and techniques. The blog mostly talks about using free forensic tools and acquisition techniques, which in our opinion can limit the available acquisition options and require more time and effort than an examiner may have at their disposal. However, the information presented in the blog is an excellent read for understanding what exactly the acquisition tools do on your behalf when acquiring information from mobile devices.

In the following sections, we will discuss the options available for acquiring information from Android devices, as well as for pulling associated data from Google servers. In this chapter, we will cover the following topics:

• Android platform fragmentation and why it matters
• AOSP and GMS demystified
• Logical acquisition via ADB backup
• Dealing with unallocated space
• Overview of advanced acquisition methods