MOBILE FORENSICS

Forensic analysis of Android backup artefacts

Backups may contain important data that is no longer available on the device itself, or is only available to a limited extent. As part of an IT forensic investigation, local and cloud-based backups often provide valuable additional information for reconstructing events.

Google backups
Local Android backups
Manufacturer backups (e.g. Samsung Smart Switch)
Historical ADB backups
Backup metadata
Synchronisation information
Timestamp
App and system data
Configuration and log files

TECHNICAL BACKGROUND

Technical Fundamentals

Android supports various security mechanisms, the scope of which may vary depending on the manufacturer, Android version and app.

Forensically relevant artefacts include, amongst others:

  • •Google backups
  • •Local Android backups
  • •Manufacturer backups (e.g. Samsung Smart Switch)
  • •Historical ADB backups
  • •Backup metadata
  • •Synchronisation information
  • •Timestamp
  • •App and system data
  • •Configuration and log files

The data actually included depends on the relevant backup settings and the applications used.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, available backup files, metadata and synchronisation artefacts are examined using recognised IT forensic tools and manual analysis. The results are correlated with data from the original device, timestamps and other technical artefacts. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which backups have been created?
  • ✔What data has been backed up?
  • ✔What timestamps are available?
  • ✔Can any differences be identified between the backup and the device?
  • ✔How significant are the available artefacts?

LIMITATIONS & CONCLUSION

What you should know

Not every backup contains all device data. Encryption, backup settings, app restrictions and data deletion operations can affect the scope of the information that can be analysed.

Backup artefacts complement the analysis of an Android device and can provide additional technical insights. A robust IT forensic assessment is always based on a comprehensive evaluation of all available artefacts.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have Android backups examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Which backups are being examined?
These include, amongst others, Google backups, local backups and manufacturer-specific backup solutions.
Are ADB backups still relevant?
Historical ADB backups may be of forensic relevance in older cases.
Are backup timestamps analysed?
Yes. They can provide information on backup times and data status.
Can backups contain deleted data?
Depending on the security procedure and the data used, this is possible.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.