Chapter 7. Understanding Android

In the previous chapters, we covered details about iOS devices, including the file system structure, key artifacts, backup files, and acquisition and analysis methods. Starting with this chapter, we will focus on the Android platform and how to perform forensics on Android devices. Having a good understanding of the Android ecosystem, security constraints, file systems, and other features proves useful during forensic investigation. Gaining knowledge of these fundamentals would help a forensic expert to make informed decisions while conducting an investigation.

We will cover the following topics in this chapter:

• The Android model
• Android security
• The Android file hierarchy
• The Android file system

The evolution of Android

Before we take a dive into the ocean of Android, let's first spend some time discussing the evolution of Android, or what we call The Android Story. Back in 2005, Google started investing money in start-up companies that it thought would be profitable in the future. Android Inc., founded in 2003 by Andy Rubin, Rich Miner, Nick Sears, and Chris White, was one such company acquired by Google that later turned out to be the best deal ever. During its first two years, Android Inc. operated under secrecy. It described itself as a company making software for mobile phones. Rubin later stayed with Google to pioneer Android as an operating system that revolutionized the way mobile handsets operate. With this acquisition, it was clear that Google was eyeing the mobile phone market. At Google, Rubin, along with his team, developed a powerful and flexible operating system built on a Linux kernel. There was speculation everywhere about what Google was trying to do. Some reported...

The Android model

To effectively understand the forensic concepts of Android, it would be helpful to have a basic understanding of the Android architecture. Just like a computer, any computing system that interacts with the user and performs complicated tasks requires an operating system to handle the tasks effectively. This operating system (whether it's a desktop operating system or a mobile phone operating system) takes the responsibility of managing the resources of the system and to provide a way for the applications to talk to the hardware or physical components to accomplish certain tasks. Android is currently the most popular mobile operating system designed to power mobile devices. You can find out more about this at: https://developer.android.com/about/android.html.

Android is open source and the code is released under the Apache license. Practically, this means anyone (especially device manufacturers) can access it, freely modify it, and use the software according to the requirements...

Android security

Android was designed with a specific focus on security. Android as a platform offers and enforces certain features that safeguard the user data present on the mobile through multi-layered security. There are certain safe defaults that will protect the user, and certain offerings that can be leveraged by the development community to build secure applications. The following are issues that are to be kept in mind while incorporating Android security controls:

• Protecting user-related data
• Safeguarding the system resources
• Making sure that one application cannot access the data of another application

The next few sections will help us understand more about Android's security features and offerings.

Note

A detailed explanation on Android security can be found at: https://source.android.com/security/.

Secure kernel

Linux has evolved as a trusted platform over the years, and Android has leveraged this fact using it as its kernel. The user-based permission model of Linux has in fact worked...

The Android file hierarchy

In order to perform forensic analysis on any system (desktop or mobile), it's important to understand the underlying file hierarchy. A basic understanding of how Android organizes its data in files and folders helps a forensic analyst narrow down their research to specific issues. Just like any other operating system, Android uses several partitions. This chapter provides an insight into some of the most significant partitions and the content stored in them.

It's worth mentioning again that Android uses the Linux kernel. Hence, if you are familiar with Unix-like systems, you will understand the file hierarchy in Android very well. For those who are not very well-acquainted with the Linux model, here is some basic information: in Linux, the file hierarchy is a single tree with the top of the tree being denoted as / (called the root). This is different from the concept of organizing files in drives (as with Windows). Whether the file system is local or remote, it...

The Android file system

Understanding the file system is one essential part of forensic methodologies. Knowledge about properties and the structure of a file system proves to be useful during forensic analysis. The file system refers to the way data is stored, organized, and retrieved from a volume. A basic installation may be based on one volume split into several partitions; here, each partition can be managed by a different file system. As is true in Linux, Android utilizes mount points and not drives (that is, C: or E:). Each file system defines its own rules for managing the files in the volume. Depending on these rules, each file system offers a different speed for file retrieval, security, size, and so on. Linux uses several file systems, and so does Android. From a forensic point of view, it's important to understand which file systems are used by Android and to identify the file systems that are of significance to the investigation. For example, the file system that stores the user...