Challenges in Android Forensics

Impact of Android Phone Rooting on User Data Integrity in Mobile Forensics

“…The exact partitioning scheme is dependent on the vendor configuration, but generally, Android phones typically have six partitions. The most common partitions are the /system, /user data, /cache, /boot, and /recovery [5], [6]. The /user data partition is the most forensically pertinent because all the data generated from apps installed by the user is deposited in this partition.…”

“…It is from the /user data partition where evidence files are often acquired. Alternatively, the /recovery partition, which is "the alternative "system" partition" [ [5], p. 288], can be exploited when the system booting fails or when the custom ROM has to be flashed. Forensic investigators use this partition when acquiring a system partition image.…”

“…When the JTAG is used first before the Android Extractor, they concluded (based on the JTAG-compatible devices that were used) that JTAG also maintained user data integrity. However, Hazra and Mateti [5] noted that the JTAG forensics technique of acquiring memory data is executed only when data acquisition via physical or logical extraction is unsuccessful and that it is risky. Although it is useful in extracting locked data, the risk of losing evidence is always there.…”

“…Some data dumping utilities may be utilized, which are contingent upon the flash storage technology in use. Many Android phones use MTD [5]. The Media Technology Device system is an extraction layer for raw (NAND) flash phones that grants software permission to use one interface in accessing multiple flash technologies or a device driver used for directly accessing NAND flash storage.…”

“…Furthermore, the fact that criminals can wipe their activity off of their smartphone's memory, thereby making it difficult for law-enforcement experts to retrieve data from the devices, has become an investigative challenge [5]. It could be that the existing criminal investigation techniques are still immature.…”