Chapter 4 - Android file systems and data structures

Abstract

This chapter discusses Android file systems and data structures focusing on different types of memory, file systems, Mounted file systems and directory structures. The physical memory, file systems, and data structures present on an Android device are the fundamental building blocks for data storage. Having a deep understanding of these structures enables users to understand an Android device and also performs research and development when presented with new file systems and data structures. Forensic analysts are primarily concerned with data artifacts that can be recovered from the devices they investigate. Android is a combination of both well-known artifacts, such as those found in Linux, and entirely new ones, such as the DalvikVM and the YAFFS2 file system. There are many nuances to this that are important to understand for effective analysis including what types of data are stored, where they are stored, how they are stored, and characteristics of the physical mediums on which they are stored. All of these factors play a major role in what data can be recovered and how they can be analyzed. Android applications primarily store data in two locations, internal and external storage. Android provides developers with five methods for storing data to a device. Forensic examiners can uncover data in at least four of the five formats. Android devices have two primary types of memory, volatile (RAM) and nonvolatile (NAND flash) memory. Each provides a different insight into the device's data.