The primary motive of forensic analysis is to extract necessary data from a device. Hence, for effective forensic analysis, it's imperative to know what kind of data is stored on the device, where it is stored, how it is stored, and details of the filesystems on which the data is stored. This knowledge is very important for a forensic analyst to make an informed decision about where to look for data and techniques that can be used to extract it. In this chapter, we are going to learn about the following topics:
- Android partition layout
- Android file hierarchy
- Application data storage on the device
- Android filesystems overview
