Conceptual evidence collection and analysis methodology for Android devices

TL;DR

This paper presents a comprehensive, device-agnostic methodology for collecting and analyzing forensic evidence from Android devices, addressing the growing need for reliable digital forensics in mobile investigations.

Contribution

It introduces an in-depth, practical evidence collection and analysis methodology specifically designed for Android devices, enhancing forensic practitioners' capabilities.

Findings

Methodology is practical and device-agnostic.

Supports effective evidence collection from Android devices.

Aims to improve forensic investigation reliability.

Abstract

Android devices continue to grow in popularity and capability meaning the need for a forensically sound evidence collection methodology for these devices also increases. This chapter proposes a methodology for evidence collection and analysis for Android devices that is, as far as practical, device agnostic. Android devices may contain a significant amount of evidential data that could be essential to a forensic practitioner in their investigations. However, the retrieval of this data requires that the practitioner understand and utilize techniques to analyze information collected from the device. The major contribution of this research is an in-depth evidence collection and analysis methodology for forensic practitioners.