MOBILE FORENSICS

Forensic analysis of Android device logs (events and system logs)

Android generates numerous system logs that document the device’s status, system events and error conditions. As part of an IT forensic investigation, these artefacts can provide valuable insights into chronological sequences and technical events.

Android Event Logs
System Logs
Kernel logs
Tombstones and crash dumps
Boot events
Security incidents
Timestamps and metadata
System-level configuration files
Features specific to the manufacturer and version

TECHNICAL BACKGROUND

Technical Fundamentals

Depending on the Android version and manufacturer, different log sources are available.

Forensically relevant artefacts include, amongst others:

  • •Android Event Logs
  • •System Logs
  • •Kernel logs
  • •Tombstones and crash dumps
  • •Boot events
  • •Security incidents
  • •Timestamps and metadata
  • •System-level configuration files
  • •Features specific to the manufacturer and version

The significance of individual records only becomes apparent when viewed in the context of other artefacts.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, system logs, event files and other log sources are analysed using recognised IT forensic tools and manual analysis. The results are correlated with Logcat, app artefacts, timestamps and other technical findings. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which system events have been logged?
  • ✔Can you identify any instances of the system restarting or crashing?
  • ✔Which security incidents have been documented?
  • ✔What timestamps are available?
  • ✔What is the technical significance of the logs?

LIMITATIONS & CONCLUSION

What you should know

Many logs are only stored for a limited period or are overwritten. Furthermore, their scope and content vary depending on the Android version, manufacturer and device configuration.

Device logs are an important source for reconstructing technical processes on Android devices. A robust assessment always requires a joint analysis of all available artefacts.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have Android system logs examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What are Android event logs?
They contain logged system events and status information.
What are tombstones?
These are logs generated following programme crashes, which may contain technical information.
Are kernel logs analysed?
Where they are available, yes.
Are timestamps in log files relevant?
Yes. They often form the basis for reconstructing events.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.