Mobile devices running the Android operating system occupy more than 80% of the mobile devices market. The variety of the operating system versions and the hardware platforms on which they are used provide a wide range of data extraction methods. There is no such range of data extraction methods for any group of the following mobile devices: iOS devices, Windows Phone devices, and BlackBerry devices.  

The most common methods of data extraction from Android devices are as follows:

• Logical extraction: This method allows to extract only certain types of logical data, such as Phonebook, Calls, Messages (SMS/MMS), and so on. As a rule, logical extraction requires the installation of an agent program that helps the mobile forensic software to extract data from a device. The installation of the program on the device is required by the hardware features of...

You will have to perform a number of preparatory steps before performing data extraction from Android devices.

Before connecting the device to the computer, you need to activate the USB Debugging mode on the device. This mode enables the ADB server on the device.

USB Debugging is activated in the following ways:

For Android 2.0-2.3.x:

1. Go to the menu of the device.
2. Select Settings.
3. In the Settings section, select Applications.
4. In the Applications section, select Development.
5. In the Development section, select USB Debugging.

For Android 3.0 to 4.1.x :

1. Go to the menu of the device.
2. Select Settings.
3. In the Settings section, select Developer Options.
4. In the Developer Options...

The program Oxygen Forensic has been already described previously in Chapter 1. In this chapter, the physical dump of a device via Oxygen Forensic will be shown. In order to make a physical dump, you need to have superuser’s permissions. You need to gain root access to the device in order to get superuser’s permissions. There are many ways to gain the root access at the Android device, the description of which is beyond the scope of this book. A special feature of Oxygen Forensic is that before the physical dump is made, the program tries to gain the root access automatically by means of consistent usage of different types of exploits. This function does not lead to any damage of the device. On one hand, this function is a great virtue, but on the other hand, it can be used only for a limited range of devices....

The best mobile forensic software, such as: UFED (Cellebrite), Oxygen Forensic, XRY (Micro Systemation), Secure View (Susteen), MOBILedit Forensic can extract data from Android devices by installing an agent program on the device. It allows to make logical extraction of data from a device.

We will use the MOBILedit Forensic program to demonstrate this method of data extraction.  This program has been described in the Chapter 1, SIM Cards Acquisition and Analysis.

Let's now explore Android device acquisition with MOBILedit Forensic:

1. When you start the program MOBILedit, the main window of the program displays information about the connected device...

Belkasoft Acquisition Tool is a universal utility that allows you to create forensic copies of hard disks and mobile devices and extract data from cloud storages. You can get the program by filling in a short form on the developer's website. After that, you will receive an email with a link to download this program.

Download the archive and unpack the program. Connect the examined device to the computer. Click on the BAT icon.

1. In the main window of the program, click on...

Magnet Acquire is a free utility designed to create forensic images of hard drives, memory cards, phones, and tablets. It can be downloaded from the Customer Portal on the Magnet Forensics website. Also, it comes with AXIOM and internet Evidence Finder.

Download the program and install it. Click on the program's icon to start it.

1. Once started, Magnet Acquire looks for connected devices and displays their list in the window.