Imaging an Android Smartphone Logically

Amber Schroader

There are a variety of imaging techniques available when you work with smartphones. With most acquisitions, we rely on logical acquisition techniques to get our evidence. As this is a well-known technique, it is always good to review the logical image processing.

Android devices, when doing logical imaging, can need some coaxing to get them to where they are going to communicate with your forensic workstation. Android has a large variety of devices as well as different versions of Android itself. When you look at the setup steps, they are typical for Android, Android Oxygen, and Android Go.

When working with the Android device, remember that if your forensic workstation cannot see it, neither can your tool. One of the tips I find helpful is to keep the Device Manager open when working with an Android. This allows you to see the device from the workstation’s perspective and how it is being loaded into the operating system. 

Figure 1-Windows Device Manager with an Android LeMobile Android Device loaded for processing.

The easiest and best method for connecting with an Android device in a forensic acquisition is to allow USB Debugging on the Android device. This is a developer option that is available once you unlock the selection on the device. This connection provides a solid connection at the lowest level of access to the device without rooting. 

Figure 2-Android Settings Dialog