MOBILE FORENSICS

Forensic analysis of Android crash dumps and tombstones

Crashes of apps or system components generate various diagnostic artefacts on Android. These can provide clues about malfunctions, system states and chronological sequences, and are therefore relevant to IT forensic investigations.

Tombstone files
Native crash dumps
Java crash logs
ANR files (Application Not Responding)
Stack traces
Timestamps and metadata
Links to Logcat and system logs
Features specific to the manufacturer and version

TECHNICAL BACKGROUND

Technical Fundamentals

Depending on the version of Android and the manufacturer, different diagnostic and crash files are generated.

Forensically relevant artefacts include, amongst others:

  • •Tombstone files
  • •Native crash dumps
  • •Java crash logs
  • •ANR files (Application Not Responding)
  • •Stack traces
  • •Timestamps and metadata
  • •Links to Logcat and system logs
  • •Features specific to the manufacturer and version

Interpretation always takes place in the context of other technical artefacts.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, tombstones, crash dumps, ANR files and other diagnostic artefacts are analysed using recognised IT forensic tools and manual analysis. The results are correlated with Logcat, system logs, timestamps and other technical findings. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which applications or processes have crashed?
  • ✔When did the crash occur?
  • ✔Can recurring errors be identified?
  • ✔Which system events are chronologically related?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Crash artefacts are often automatically overwritten or deleted. The scope and level of detail depend on the Android version, the manufacturer, the debug configuration and the data actually available.

Crash dumps and tombstones provide valuable technical information about system and app errors. A robust forensic assessment requires the joint analysis of all available artefacts.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have Android crash dumps or tombstones professionally analysed? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What are tombstones?
Diagnostic files that may be generated following native process crashes.
What does ANR stand for?
ANR stands for ‚Application Not Responding‘ and records applications that have frozen.
Are stack traces analysed?
Yes. They can provide clues as to the cause of a crash.
Are crash dumps conclusive evidence in their own right?
No. They must be assessed within the overall technical context.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.