Logical Image Acquisition and Analysis of Android Smartphones

作     者：Nursel Yalçın Tayfun Yıldırım Nursel Yalçın;Tayfun Yıldırım

作者机构：Department of Computer and Instructional Technologies Education Faculty of Education Gazi University Ankara Türkiye Department of Computer Forensics Institute of Informatics Gazi University Ankara Türkiye 

出 版 物：《Journal of Computer and Communications》 (电脑和通信（英文）)

年 卷 期：2024年第12卷第4期

页      面：139-152页

学科分类：08[工学] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

主　　题：Android Smartphone Forensics Data Acquisition Data Analysis Root Privileges Digital Forensics 

摘      要：Android smartphones largely dominate the smartphone market. For this reason, it is very important to examine these smartphones in terms of digital forensics since they are often used as evidence in trials. It is possible to acquire a physical or logical image of these devices. Acquiring physical and logical images has advantages and disadvantages compared to each other. Creating the logical image is done at the file system level. Analysis can be made on this logical image. Both logical image acquisition and analysis of the image can be done by software tools. In this study, the differences between logical image and physical image acquisition in Android smartphones, their advantages and disadvantages compared to each other, the difficulties that may be encountered in obtaining physical images, which type of image contributes to obtaining more useful and effective data, which one should be preferred for different conditions, and the benefits of having root authority are discussed. The practice of getting the logical image of the Android smartphones and making an analysis on the image is also included. Although root privileges are not required for logical image acquisition, it has been observed that very limited data will be obtained with the logical image created without root privileges. Nevertheless, logical image acquisition has advantages too against physical image acquisition.