Rooting Androids for Forensics

When you look at the different imaging options for Android devices, you cannot ignore the value of getting root. Root-level access allows you more access to the device's data. If you have read the prior article about logical imaging with Android devices in forensics, you probably noted that app access can be very limited. This obstacle is not there when the root is acquired. If the time for research and rooting is available, it is highly recommended that it be added to the Android process steps.

Let’s start out by making sure we understand what the root is. The root is the level of access or control of a device. In general, it is the highest permission level on the device, and sometimes it is referred to as the “superuser.” The root is typically reserved as a method to protect the primary file system of the device from damage or malicious access. When looking at the root, there are a lot of different methods out there that can help you through this process. It is important to note that most of the root methods are not designed for digital forensics, but are designed, so consumers can gain greater access to and control of their devices. 

Once you understand the root, you might wonder how it can be used in smartphone forensics and still be considered as a forensic method. That is where the implementation and the documentation play a strong role in your investigation.