It is important that we begin the discussion with the Android SDK. The Android Software Development Kit (SDK) helps developers build, test, and debug applications to run on Android. It includes software libraries, APIs, emulator, reference material, and many other tools. These tools not only help create Android applications but also provide documentation and utilities that help significantly in forensic analysis of Android devices. Having sound knowledge of the Android SDK can help you understand the particulars of a device. This, in turn, will help you during an investigation.

During forensic examination, the SDK helps us connect the device and access the data present on the device. The SDK is supported in most of environments, including Windows, Linux, and OS X. It can be downloaded for free from http://developer.android.com/sdk/index.html.

In order to extract information from an Android device, it first needs to be connected to the workstation. As mentioned earlier, care should be taken to make sure that the workstation is forensically sterile and used only for the purpose of investigation. A forensically sterile workstation is one that has a proper build and is free from viruses and other malware. When a device is connected to the computer, changes can be made to the device. Hence, it is crucial that the forensic examiner maintains control over the device at all times. In the world of mobile forensics, using write-protection mechanisms may not be of great help, as they prevent successful acquisition of the device. This is because during acquisition, certain commands need to be pushed to the device to extract the necessary data.

In Android forensics, Android Debug Bridge (ADB) plays a very crucial role. It is present at <sdk_path>/platform-tools. In order to work with ADB, the USB-debugging option needs to be enabled. On a Samsung phone, you can access this by going to Settings | Developer options; as shown in the following screenshot:

The USB debugging option in Android

However, this may not be the case with all the devices, as different devices have different environments and configuration features. Sometimes, the examiner might have to use certain techniques to access the developer options on a few devices. These techniques are device specific and need to be researched and determined by the forensic analyst, based on the device type and model.

Once the USB debugging option is selected, the device will run the adb daemon ...

"Rooting" is a word that is very often heard with respect to Android devices. As a forensic examiner, it is essential to understand this in detail. This will help you gain the knowledge that is required to understand the internals of the device. It will also help you gain expertise on several issues that are encountered during an investigation. Rooting Android phones has become a common phenomenon and rooted phones are very often encountered during investigations. Also, depending on the situation and data to be extracted, the examiner himself has to root the device in order to extract certain data. The following sections talk about rooting an Android device and other related concepts.

We have already seen how the ADB tool can be used to interact with the device and execute certain commands on the device. However, on a normal Android phone, certain locations, such as /data/data, cannot be accessed. For example, the following the command-line output appears when you try to access /data/data on a normal device:

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb.exe shell
shell@android:/ $ cd /data/data
cd /data/data
shell@android:/data/data $ ls
ls
opendir failed, Permission denied

This is because the private data of all the applications is stored in this folder. Thus, the security is enforced by Android. Only the root user has access to this location. Hence, on a rooted device, you will be able to see all the data under this location, as shown in the following commands:

C:\Program Files (x86)\Android\android-sdk\platform-tools>adb.exe shell
shell@android:/ # ls /data/data
ls /data/data
android.googleSearch.googleSearchWidget
com.android...

Setting up a proper forensic environment is crucial prior to conducting investigation on an Android device. The Android SDK installation is necessary to use tools such as ADB that come along with it. Using ADB, an examiner can communicate with the device, view folders on the device, and pull data and copy data to the device. However, not all folders can be accessed on a normal phone in this manner. This is because the device's security enforcements prevent an examiner from viewing the locations that contain private data. Rooting a device solves this issue, as it provides unlimited access to all the data present on the device. Rooting a device with an unlocked boot loader is straightforward, while rooting a device with a locked boot loader involves exploiting some security bug.

With this knowledge about accessing the device, you will now learn how data is organized on an Android device and many other details in Chapter 3, Understanding Data Storage on Android Devices.