Android Analysis

Android devices, just like iOS, are used by millions of people worldwide and have become key devices that humans interact with more often than PCs or laptops. This makes them an essential part of people's digital lives, with their information frequently being deeply intertwined with online services and apps. From a forensic point of view, these mobile devices hold immense amounts of evidence that can be used in various incidents.

In this room, we will focus on Android devices and understand the importance of learning how to perform forensic investigations.

Scenario

In this room, we will work on a scenario where employee Hazem is suspected of misusing his authority to sell company secrets outside the company. The company thinks he has sensitive documents on his Android device and may have transferred them to someone outside the company. The forensics team confiscated and captured the forensic image of his device. 

Your task is to examine the artifacts and identify the key evidence.

Learning Objectives

In this room, we will explore the following learning objectives:

• Understand the Android architecture.
• Android filesystem and key components.
• Learn about the key artifacts.
• How and where to locate the artifacts.
• How to examine the artifacts.

Prerequisites

As this room is based on Android analysis, it is expected that users are familiar with the Linux OS and have covered the following rooms and modules:

• DFIR: An Introduction
• Linux Fundamentals Module
• iOS Analysis
• Mobile Acquisition

Let's begin our learning journey.