Recovering data deleted from an SD card
Data present on an SD card can reveal a lot of information that is useful during a forensic investigation. The fact that pictures, videos, voice recordings, application data, and so on are stored on the SD card adds weight to this. As mentioned in the previous chapters, Android devices often use the FAT32 filesystem on the SD card. The main reason for this is that the FAT32 filesystem is widely supported in most operating systems, including Windows, Linux, and Mac OS X. The maximum file size on a FAT32-formatted drive is around 4 GB. With increasingly high resolution formats that are now available, this limit is commonly reached. Recovering the data deleted from an external SD can be pretty easy if it can ...
Get Learning Android Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
