Page 1

SECUREFOLDERS & CONTAINERS · A GUIDE FOR UK LAWYERS Android Secure Folders, Knox and Manufacturer Security Containers A Second, Separately Locked Phone Inside the Phone, and Why It Is So Often Where the Evidence Is COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a second phone inside the phone 03 The containers: Secure Folder, Knox, private spaces and work profiles 04 How containers are secured 05 Finding the container and reaching it law full y 06 What a container holds, and honest limits 07 Deployment: the concealed second life 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: many Android phones carry a second, separately secured space, Samsung's Knox-based Secure Folder, other makers' private spaces, or Android's work profile, each a second phone inside the phone with its own apps, second-account messaging, photos and files, sealed behind its own credential and keys and must be looked for on every device and reached law full y.

§ 02 · FIRST PRINCIPLES The problem in plain English: a second phone inside the phone

§ 03 · THECONTAINERS The containers: Secure Folder, Knox, private spaces and work profiles