MOBILE FORENSICS
Detecting anti-forensics on Android
The term ‘anti-forensics’ refers to technical measures designed to hinder subsequent analysis, conceal artefacts or remove traces. In the context of an Android forensic investigation, identifying such measures is one of the key tasks, as they can influence the interpretation of the investigation’s findings.
TECHNICAL BACKGROUND
Technical Fundamentals
Anti-forensic measures can occur at various levels of the Android system.
Forensic aspects:
- •Safe fire-extinguishing procedures
- •Root-Hiding and Magisk DenyList
- •Tampering with log files
- •Changes to timestamps
- •Hiding apps or processes
- •Changes to system partitions
- •Custom ROMs and kernel modifications
- •Changes to the bootloader or recovery
Not every anomaly automatically constitutes an attempt at manipulation. The technical assessment is always carried out within the overall context.
OUR APPROACH
This is how your examination will be carried out
A transparent process – from the initial enquiry to the handover of the report.
TYPICAL QUESTIONS
When is this analysis required?
- ✔Is there any evidence of anti-forensics?
- ✔Have any log files or timestamps been altered?
- ✔Are there any root-hiding techniques?
- ✔What impact does this have on the validity of the study?
- ✔What technical conclusions can objectively be drawn?
LIMITATIONS & CONCLUSION
What you should know
Not every change to the system is the result of an anti-forensics measure. Similarly, the absence of relevant artefacts cannot prove that no tampering has taken place. The assessment is always based on the totality of all available technical evidence.
The identification of potential anti-forensics measures is a key component of modern Android forensics. However, a robust assessment requires a comprehensive analysis of all relevant artefacts.
CUSTOMER REVIEWS
What our customers say
4.8 out of 5 stars on Trustpilot · 54 reviews
“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”
idalein
Verified review on Trustpilot
“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”
Layla Pankratz
Verified review on Trustpilot
“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”
a woman from Cologne
Verified review on Trustpilot
Enquire now – free initial consultation
Would you like to have an Android device examined to see if it shows any signs of tampering or anti-forensic measures? LanCologne can assist you with an objective IT forensic investigation and comprehensive expert documentation.
RELATED TOPICS
You might also be interested in
FREQUENTLY ASKED QUESTIONS
Frequently Asked Questions
Click on a question to see the answer.