In this chapter, we covered the Android operating system's underlying features, filesystems, and other details that are useful in a forensic investigation. We learned about interesting security capabilities that are built into Android. Unlike iOS, several variants of Android exist as many devices run the Android operating system, and each may have different filesystems and unique features. The fact that Android is open and customizable also changes the playing field of digital forensics. This knowledge will be helpful to understand forensic acquisition techniques.
In the next chapter, we will discuss how to set up a forensic workstation before performing the analysis.
