Summary
Recovery of the deleted data on Android devices depends on various factors, which heavily rely on access to the data residing in the internal memory and SD card. While the recovery of deleted items from external storage, such as an SD card, is easy, the recovery of deleted items from the internal memory takes considerable effort. SQLite file parsing and file carving techniques are two methods that are used to recover deleted data extracted from an Android device.
The next chapter discusses forensic analysis of Android apps, malware, and the reverse engineering of Android apps.
Get Practical Mobile Forensics - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
