Page 1
ANDROIDPHOTOS & MEDIA · A GUIDE FOR UK LAWYERS Android Photos, Media and Metadata The Gallery, the Media Store, Google Photos and the SD Card: Where an Android Image Lives, and What It Records COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the same picture, more places 03 Where Android images live 04 The media store and Google Photos 05 Removable storage: the SD card 06 Reading metadata, location and dates honestly 07 Deployment: recovering and placing images 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: an Android photograph records the same when, where and on-what as an iPhone's and photograph.
§ 02 · FIRST PRINCIPLES The problem in plain English: the same picture, more places
§ 03 · WHEREIMAGESLIVE Where Android images live
Page 2
§ 04 · MEDIASTOREANDGOOGLEPHOTOS The media store and Google Photos
§ 05 · THESDCARD Removable storage: the SD card
§ 06 · HONESTREADING Reading metadata, location and dates honestly
§ 07 · DEPLOYMENT Deployment: recovering and placing images
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE STORE / SD CARD COPIES / PHONE GOOGLE BACKUP S / FILES PHOTOS MAKER CLOUD MEDIA SHARE D TRASH PLATFORMS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDPHOTOSFOUNDINTHEINDEXANDTHECLOUD EXAMPLE2 · THESDCARDTHATTHESEALEDPHONECOULDNOTPROTECT EXAMPLE3 · THEDATETHATMEANTSOMETHINGELSE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROIDMEDIAANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android media checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions How is an Android photo different from an iPhone photo, forensic all y? What is the media store? Can deleted photos be recovered from an Android phone? Does the SD card matter? Which date on a photo is the real one? We only have a photo someone sent us. Is that enough?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Photos Media And Metadata, Computer Forensics Lab, https://e-discovery.uk/library/android-photos-media-and-metadata/pdf.