Page 1

ANDROIDFORENSICS · A GUIDE FOR UK LAWYERS Android Forensics: The Fragmented Landscape Why No Two Android Phones Are Alike, and What That Means for the Evidence COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ANDROID FORENSICS ACROSS MANUFACTURERS PER-DEVICE FEASIBILIT Y ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a landscape, not a platform 03 The sources of fragmentation 04 How fragmentation shapes acquisition 05 What is consistent across Android 06 Assessing this device: feasibility and honest expectations 07 Deployment: getting the most from the device in hand 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Android is not one platform but a fragmented landscape of manufacturers, models, for this device, this model, this version and this security state, which must be assessed before expectations are set.

§ 02 · FIRST PRINCIPLES The problem in plain English: a landscape, not a platform

§ 03 · THESOURCESOFFRAGMENTATION The sources of fragmentation