Page 1

ANDROIDAPPDATA · A GUIDE FOR UK LAWYERS Android App Data and Third-Party Application Forensics Sandboxes, Sideloading and the Open Ecosystem: Every App Its Own World, and Some Worlds Stranger Than Others COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: an open ecosystem of worlds 03 How Android apps store their data 04 What the open ecosystem adds 05 Inventorying and recovering app data 06 Interpretation, attribution and honest limits 07 Deployment: the evidence inside the apps 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary files that must be under stood on their own terms, and the open ecosystem adds dimensions iOS lacks, sideloaded and obscure apps, cloned and "dual" apps running second accounts, app data on the SD card, and selective Google backup, so the apps must be inventoried including the unexpected ones, each under stood precisely, and the evidence inside recovered and attributed with care.

§ 02 · FIRST PRINCIPLES The problem in plain English: an open ecosystem of worlds

§ 03 · HOWAPPSSTOREDATA How Android apps store their data