Most commercial tools that attempt to physically acquire an Android device require that the device enter a mode referred to as Download Mode. Download Mode allows the user to flash the ROM of the device, which then allows the tool to create a forensic image. Flashing the ROM leaves traces on the device. When the custom ROM of the device is modified, it’s tracked within the device. When the device enters Download Mode, the number of flash counts (ROM changes) are listed.

To enter Download Mode, a specific cable or key combination may be required. Each device may have a unique key combination required. The easiest way to get into Download Mode is to follow the instructions provided by the forensic tool.

The screenshot shows a device that has the original, custom ROM and has not been modified by a forensic tool or user. This state is represented by the picture below. If a device ROM had been modified, the CUSTOM BINARY DOWNLOAD indicator would say YES or retain the count for the number of times it was flashed, and the CURRENT BINARY may reference something like CUSTOM (or anything other than the OFFICIAL binary that shipped with the device). Keep in mind, your forensic tools make these modifications. If you are conducting covert operations, make sure that you pay attention to what you leave behind!

NOTE: Not all devices can enter Download Mode. We recommend researching your specific device if you are having a hard time entering Download Mode. 

Graphic from https://for585.com/flash.