MOBILE FORENSICS

Android Backups – Options and Limitations

Backups are often an important source of data in Android forensics. They may contain information that is no longer readily available on the device itself. At the same time, a backup is no substitute for a full forensic extraction, as the nature and scope of the backed-up data depend on numerous technical factors.

Google Cloud Backups
Local device backups
Manufacturer solutions (e.g. Samsung Smart Switch)
Historical ADB backups
App-specific backups
Encrypted backups

TECHNICAL BACKGROUND

Technical Fundamentals

Depending on the device and the version of Android, there are various backup options available.

Backup sources of forensic relevance include, amongst others:

  • •Google Cloud Backups
  • •Local device backups
  • •Manufacturer solutions (e.g. Samsung Smart Switch)
  • •Historical ADB backups
  • •App-specific backups
  • •Encrypted backups

The contents of a backup vary depending on the backup method, the version of Android and the settings of the relevant app.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Before the analysis begins, the origin and integrity of the backup are verified. The data contained therein is then analysed using recognised IT forensic tools as well as manually, and cross-referenced with other available artefacts. All stages of the investigation are documented in a manner that allows for full traceability.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What data does a backup contain?
  • ✔What information is missing compared with a forensic extraction?
  • ✔Can deleted data be recovered?
  • ✔What role does encryption play?
  • ✔How reliable is a backup?

LIMITATIONS & CONCLUSION

What you should know

A backup usually contains only part of the information stored on a device. Depending on the backup method, system data, app data or metadata may be missing. The value of a backup must therefore always be assessed within the overall technical context.

Android backups are a valuable addition to forensic investigations, but they are no substitute for a full data backup. Only by combining various data sources is it possible to carry out a thorough technical assessment.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have an Android backup professionally analysed? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Does a backup replace a forensic extraction?
No. A backup often contains only part of the available data.
Can Google backups be used for forensic purposes?
Yes, provided they are lawfully available and contain relevant data.
Do manufacturer backups differ?
Yes. The size and format vary depending on the manufacturer.
Could it contain deleted data?
That depends on the backup method and the specific application.
Could an expert report be drawn up on this matter?
Yes. The results of the investigations can be documented and assessed in a transparent manner.