Chapter 3. Understanding Data Storage on Android Devices

The primary motive of forensic analysis is to extract necessary data from the device. Hence, for effective forensic analysis, it is imperative to know what kind of data is stored on the device, where it is stored, how it is stored, and the details of the filesystems on which the data is stored. This knowledge is very important to a forensic analyst to take an informed decision about where to look for data and the techniques that can be used to extract the data. In this chapter, we will cover the following topics:

• Android partition layout and file hierarchy
• Application data storage on the device
• An overview of the Android filesystem