MOBILE FORENSICS

Forensic analysis of Android file system artefacts

The Android file system contains numerous artefacts that provide insights into a device’s usage. Alongside user data, directory structures, metadata and internal system files play an important role in mobile IT forensics.

/data
/sdcard
/storage
/system
App-specific directories
Cache folder
Temporary files
SQLite, WAL and SHM files
File metadata and permissions
Log and configuration files

TECHNICAL BACKGROUND

Technical Fundamentals

The structure and storage locations of individual artefacts vary depending on the Android version and the manufacturer.

Areas of forensic relevance include, amongst others:

  • •/data
  • •/sdcard
  • •/storage
  • •/system
  • •App-specific directories
  • •Cache folder
  • •Temporary files
  • •SQLite, WAL and SHM files
  • •File metadata and permissions
  • •Log and configuration files

The assessment is always carried out in conjunction with other technical artefacts.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, the file system structure, metadata and relevant artefacts are examined using recognised IT forensic tools and manual analysis. Directories, databases and timestamps are correlated with one another and documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which directories contain relevant data?
  • ✔What app artefacts are available?
  • ✔What metadata can be analysed?
  • ✔Which cache or log files are relevant?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

File encryption, deletion processes, data cleansing or manufacturer-specific customisations may limit the availability of individual artefacts. Assessments are based solely on objectively verifiable technical findings.

Analysis of the Android file system forms the basis of numerous mobile IT forensic investigations. Only by combining all available artefacts is it possible to carry out a robust technical assessment.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have the file system of an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Why are WAL files important?
They may contain information that has not yet been permanently added to the database.
Are cache files scanned?
Yes. They can provide further information on device usage.
Are file permissions relevant?
Yes. They help with the technical classification of files and applications.
Are the storage locations different?
Yes. They vary depending on the version of Android and the manufacturer.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.