Android filesystem overview

Understanding the filesystem is very important in Android forensics, as it helps us to gain knowledge on how data is stored and retrieved. This knowledge about properties and the structure of a filesystem proves to be useful during forensic analysis. Filesystem refers to the way data is stored, organized, and retrieved from a volume. A basic installation may be based on one volume split into several partitions; here, each partition can be managed by a different filesystem. Microsoft Windows users are familiar with FAT32 or NTFS filesystems, whereas Linux users are more familiar with EXT2 or EXT4 filesystems. As is true in Linux, Android utilizes mount points and not drives (that is, C: or E:). Each filesystem defines its own rules for managing the files on the volume. Depending on these rules, each filesystem offers a different speed for file retrieval...