Information Technology Reference
In-Depth Information
The Super Backup Android app
Upon detection of a backup application, the forensic examiners must attempt to determine
where the data is stored. The data saved in a backup may contain important information
and thus looking for any third-party backup app on the device would be very helpful.
Recovering data deleted from internal memory
Recovering files which are deleted from Android's internal memory (such as SMS, con-
tacts, app data, and more) is not supported by all analytical tools and may require manual
carving. Unlike some media containing common file systems such as SD cards, the file
system may not be recognized and mounted by forensic tools. Also, the examiner cannot
get access to the raw partitions of the internal memory of an Android phone unless the
phone is rooted. The following are some of the other issues the examiner may face when
attempting to recover data from the internal memory on Android devices:
