First, we need to talk about some basics.
Android uses NAND flash memory.
So if you think back to when we talked
about solid-state storage and how the data's moved around
on the device, that's what we're going to see with Android.
Where leveling will be into play.
However, starting with Android, I think Samsung Galaxy S3,
Garbage Collection started cleaning up.
In addition to garbage collection, which
cleans the entire device, you will
have databases being vacuumed, which
is going to go through and clear anything marked for deletion.
We are going to have an operating system that
is based on the Linux kernel.
We will also see, with Android, things
get a little bit difficult. If you look at the third bullet,
Android is open source, which means users can
do many things with Android.
Manufacturers can do many things with Android.
You will find different flavors as you
go through these devices, and you
have to handle them in different ways.
Most data is going to be stored in SQLite databases.
So if you enjoyed the last lab, amazing.
If you hated it, do not panic.
The tools will do a great job at parsing most
of this information for you.
We're also going to see something unique here.
This application sandboxing, this will really come into play
at the end of section 2.
At the end of section 2, we are going
to try to put a user at a location
when an artifact was created and say the person actually created
that thing.
The UID, this Unique ID for applications,
will be tracked with battery stats
and other things of interest that will tell you the truth.
What's killing the battery?
What's happening on the device at that point in time?
Android, unfortunately, if you asked me,
I don't know maybe five years ago,
I would say Android is probably the easiest device to acquire.
Android is now becoming the most difficult.
And the reason are the variances.
Is it full-disk encryption?
Is it file-based encryption?
What chipset is on it?
There's so many different manufacturers,
and there are so many different versions of Android
that exist in the wild--
whereas, compared to iOS, most people
are probably between iOS 13 and 15.
For Android, my dad is still using
Android version 5 I think.
We're up to 12.
You have to be ready for the unexpected
when it comes to Android.