MOBILE FORENSICS

Forensic analysis of Android file managers and downloads

The file manager and the downloads section of an Android device often contain valuable information about stored documents, images, archives and other files. As part of an IT forensic investigation, these artefacts can provide clues about user activity and file movements.

Downloads folder
Documents (PDFs, Office files, etc.)
Most recently opened files
File metadata
Timestamp
Cache and temporary files
Recycle bin functions (where available)
SQLite databases
Manufacturer- and app-specific file management artefacts

TECHNICAL BACKGROUND

Technical Fundamentals

Android manages files using both the system’s own file manager and manufacturer-specific file managers.

Forensically relevant artefacts include, amongst others:

  • •Downloads folder
  • •Documents (PDFs, Office files, etc.)
  • •Most recently opened files
  • •File metadata
  • •Timestamp
  • •Cache and temporary files
  • •Recycle bin functions (where available)
  • •SQLite databases
  • •Manufacturer- and app-specific file management artefacts

The type and scope of the available data depend on the Android version, the manufacturer and the apps used.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, file system artefacts, metadata and file management information are analysed using recognised IT forensic tools and manual analysis. Timestamps are correlated with other technical findings. All stages of the investigation are documented in a reproducible manner and assessed solely on the basis of objective technical findings.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which files were downloaded?
  • ✔What documents are available?
  • ✔Which files were last opened?
  • ✔Is it technically possible to recover deleted files?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Deleted files, overwrites, data cleansing processes or manufacturer-specific changes may limit the available data set. Any statements are made solely on the basis of the technical artefacts that are actually present.

Analysing file managers and download artefacts often provides important insights into the use of an Android device. Only a comprehensive analysis of all available data sources enables a reliable IT forensic assessment.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have files or downloads from an Android device examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Which files are scanned?
These include, amongst other things, documents, images, archives, downloads and other locally stored files.
Is file metadata relevant?
Yes. Among other things, they provide information on timestamps and file properties.
Can deleted files be recovered?
That depends on the data set and the artefacts available.
Are temporary files analysed?
Yes. Cache and temporary files can provide further technical information.
Could an expert report be drawn up on this matter?
Yes. The test results are documented in a clear and transparent manner and assessed from a technical perspective.