Android Forensic Setup and Pre Data Extraction Techniques - Practical Mobile Forensics - page 240

files present under this directory, the following are the files that are of interest for a
forensic analyst:
• cache.img : This is the disk image of the /cache partition (remember that we
discussed the /cache partition of an Android device in Chapter 7 , Understand-
ing Android ).
• sdcard.img : This is the disk image of the SD card partition.
• Userdata-qemu.img : This is the disk image of the /data partition. The
/data partition contains valuable information about the device user.