Android Acquisition Logical File System And Physical
ANDROIDACQUISITION · A GUIDE FOR UK LAWYERS Android Acquisition: Logical, File System and Physical Three Depths of Extraction, and Why the Method Chosen Decides What the Court Will Ever See COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the method decides the evidence 03 The three depths and what each reaches 04 How the device decides which is possible 05 Integrity, verification and the record of method 06 Reading a report in the light of its method 07 Deployment: choosing, obtaining and defending the depth 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: on Android the acquisition method decides the evidence, a logical extraction takes only what the device hands over, a file-system extraction reaches the storage and app databases including deleted not degree, so the depth must be asked about for every device and every report.
§ 02 · FIRST PRINCIPLES The problem in plain English: the method decides the evidence
§ 03 · THETHREEDEPTHS The three depths and what each reaches LOGICAL FILE SYSTEM PHYSICAL DELETED DATA VERIFIED
§ 04 · WHATTHEDEVICEDECIDES How the device decides which is possible
§ 05 · INTEGRITY AND METHOD Integrity, verification and the record of method
§ 06 · READINGAREPORT Reading a report in the light of its method
§ 07 · DEPLOYMENT Deployment: choosing, obtaining and defending the depth
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ACCOUNT / LOGICAL FILE-SYSTEM PHYSICAL COUNTERPART / EXTRACTION EXTRACTION EXTRACTION PROVIDER GOOGLE BACKUPS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEREPORTTHATWASSILENTABOUTWHATITCOULDNOTSEE EXAMPLE2 · THEDEVICEWHOSECEILINGWASLOW, ANDTHEESTATETHATWASNOT EXAMPLE3 · THEMETHODTHATWASRECORDED, ANDTHECHALLENGETHATFAILED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROID AC QUISITION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android acquisition checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What is the difference between logical, file-system and physical extraction? Why does the acquisition method matter so much for the evidence? Can the examiner just choose the deepest method? The other side's report says nothing was found. Should we accept that? How is an extraction made defensible? What if the device only permits a shallow extraction?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Acquisition Logical File System And Physical, Computer Forensics Lab, https://e-discovery.uk/library/android-acquisition-logical-file-system-and-physical/pdf.