Page 1
ANDROIDFORENSICS · A GUIDE FOR UK LAWYERS Android Forensics: The Fragmented Landscape Why No Two Android Phones Are Alike, and What That Means for the Evidence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANDROID FORENSICS ACROSS MANUFACTURERS PER-DEVICE FEASIBILIT Y ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a landscape, not a platform 03 The sources of fragmentation 04 How fragmentation shapes acquisition 05 What is consistent across Android 06 Assessing this device: feasibility and honest expectations 07 Deployment: getting the most from the device in hand 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: Android is not one platform but a fragmented landscape of manufacturers, models, for this device, this model, this version and this security state, which must be assessed before expectations are set.
§ 02 · FIRST PRINCIPLES The problem in plain English: a landscape, not a platform
§ 03 · THESOURCESOFFRAGMENTATION The sources of fragmentation
Page 2
§ 04 · ACQUISITION How fragmentation shapes acquisition
§ 05 · WHATISCONSISTENT What is consistent across Android
§ 06 · ASSESSINGTHISDEVICE Assessing this device: feasibility and honest expectations
§ 07 · DEPLOYMENT Deployment: getting the most from the device in hand
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (DEPTH BACKUPS DEVICE VARIES) GOOGLE MANUFACTURER PAIRED / PROVIDER / ACCOUNT CLOUD COUNTERPART CARRIER
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THETWOANDROIDSTHATBEHAVEDNOTHINGALIKE EXAMPLE2 · THEUPDATETHATCLOSEDTHEDOOR EXAMPLE3 · THECOMMONCORETHATMADETHEANALYSISPOSSIBLE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROIDFEASIBILITYASSESSMENT AND ACQUISITION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android landscape checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why is Android so different from iPhone forensic all y? What can be recovered from an Android phone? Does the acquisition method matter more on Android? Can an update really change what's possible? Is anything the same across all Android phones? What if the specific Android device yields very little?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Forensics The Fragmented Landscape, Computer Forensics Lab, https://e-discovery.uk/library/android-forensics-the-fragmented-landscape/pdf.