The Android file hierarchy

In order to perform forensic analysis on any system (desktop or mobile), it's important to understand the underlying file hierarchy. A basic understanding of how Android organizes its data in files and folders helps a forensic analyst narrow down their research to specific issues. Just like any other operating system, Android uses several partitions. This chapter provides an insight into some of the most significant partitions and the content stored in them.

It's worth mentioning again that Android uses the Linux kernel. Hence, if you are familiar with Unix-like systems, you will understand the file hierarchy in Android very well. For those who are not very well-acquainted with the Linux model, here is some basic information: in Linux, the file hierarchy is a single tree with the top of the tree being denoted as / (called the root). This is different from the concept of organizing files in drives (as with Windows). Whether the file system is local or remote, it...