Summary
Data recovery is the process of retrieving deleted data from the device. Thus, it is a very important concept in forensics. In this chapter, we saw various techniques to recover deleted data from both an SD card and internal memory. While recovering the data from a removable SD card is easy, recovering data from internal memory involves a few complications. SQLite file-parsing and file-carving techniques aid a forensic analyst in recovering the deleted items that are present in the internal memory of the Android device. Checking for any installed backup apps on the device is recommended as it saves both time and effort.
In the next chapter, we will try to understand the forensic perspective on analysis of Android apps.
Get Learning Android Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
