In the previous chapters, we covered details about iOS devices, including the filesystem structure, key artifacts, backup files, and acquisition and analysis methods. Starting with this chapter, we will focus on the Android platform and how to perform forensics on Android devices. Having a good understanding of the Android ecosystem, security constraints, filesystems, and other features would prove useful during a forensic investigation. Gaining knowledge of these fundamentals would help a forensic expert to make informed decisions while conducting an investigation.

We will cover the following topics in this chapter:

• The evolution of Android
• The Android architecture
• Android security
• The Android file hierarchy
• The Android filesystem