MOBILE FORENSICS

Forensic analysis of Android USB and OTG artefacts

USB connections and OTG devices can leave technical traces on Android devices. Depending on the device and Android version, these artefacts provide information about connected hardware, transfer types and configurations.

USB connection information
OTG devices (USB-Sticks, SSDs, etc.)
MTP, PTP and ADB modes
USB debugging
Device identifiers
Timestamps and metadata
System logs
Features specific to the manufacturer and version

TECHNICAL BACKGROUND

Technical Fundamentals

Android stores various details about USB connections and OTG usage.

Forensically relevant artefacts include, amongst others:

  • •USB connection information
  • •OTG devices (USB-Sticks, SSDs, etc.)
  • •MTP, PTP and ADB modes
  • •USB debugging
  • •Device identifiers
  • •Timestamps and metadata
  • •System logs
  • •Features specific to the manufacturer and version

The availability and scope of the data vary depending on the Android version and the manufacturer.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, USB-related configuration files, system logs and other artefacts are examined using recognised IT forensic tools and manual analysis. The results are correlated with timestamps, system settings and other technical artefacts. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Have any USB devices been connected?
  • ✔Was USB debugging enabled?
  • ✔Which transmission modes were used?
  • ✔Is it possible to trace the timing of connections?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Not every instance of USB or OTG usage leaves behind traces that can be analysed in the long term. The significance and scope of the artefacts depend on the device, the Android version and the usage scenario.

USB and OTG artefacts supplement the reconstruction of device usage and can help to clarify technical relationships. A reliable assessment is always made in the context of all available artefacts.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have USB or OTG artefacts from an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Are USB connections relevant from a forensic perspective?

Yes. Depending on the data source, they can provide information about connected devices.

What is OTG?

USB On-The-Go allows external devices to be connected directly to an Android device.

Are ADB connections taken into account?

Yes. Where such artefacts exist, they are analysed.

Do USB artefacts vary depending on the manufacturer?

Yes. Storage locations and data structures vary.

Could an expert report be drawn up on this matter?

Yes. The results are documented in a transparent manner and assessed from a technical perspective.