Introduction
Android is the world’s most widely used mobile operating system, powering billions of smartphones, tablets, smart televisions, wearable devices, and Internet of Things (IoT) products.
Developed initially by Android Inc. and later acquired by Google in 2005, Android has evolved into a sophisticated and feature-rich platform.
Due to its widespread adoption and the significant amount of personal and business information stored on Android devices, Android has become a critical source of digital evidence in criminal investigations, civil litigation, corporate inquiries, and family court proceedings.
Digital forensic investigators frequently examine Android devices to recover communications, application data, location information, browsing history, media files, and system logs. Understanding Android’s history and the forensic artefacts it generates is essential for effective evidence collection and analysis.
History of Android
Origins of Android
Android was originally developed by Android Inc., a company founded in 2003 by Andy Rubin, Rich Miner, Nick Sears, and Chris White. The company initially focused on developing software for digital cameras but later shifted its attention toward mobile devices.
Google acquired Android Inc. in 2005, recognising the growing importance of the smartphone market. Following the acquisition, Google continued developing the operating system based on the Linux kernel.
Launch of Android
In 2007, Google announced the formation of the Open Handset Alliance (OHA), a consortium of technology companies committed to developing open standards for mobile devices.
The first commercial Android smartphone, the HTC Dream (also known as the T-Mobile G1), was released in 2008. It introduced features such as:
- Touchscreen navigation
- Google Maps integration
- Gmail synchronisation
- Android Market (later Google Play Store)
- Evolution of Android Versions
- Android versions were traditionally named after desserts:
- Android 1.5 Cupcake (2009)
- Android 1.6 Donut (2009)
- Android 2.0 Eclair (2009)
- Android 2.2 Froyo (2010)
- Android 2.3 Gingerbread (2010)
- Android 4.0 Ice Cream Sandwich (2011)
- Android 4.4 KitKat (2013)
- Android 5.0 Lollipop (2014)
- Android 6.0 Marshmallow (2015)
- Android 7.0 Nougat (2016)
- Android 8.0 Oreo (2017)
- Android 9 Pie (2018)
Beginning with Android 10, Google discontinued public dessert branding and adopted numerical version names.
Android Security Advancements
Over time, Android introduced significant security improvements, including:
- Full Disk Encryption (FDE)
- File-Based Encryption (FBE)
- Secure Boot
- Verified Boot
- Application Sandboxing
- Google Play Protect
- Hardware-backed keystores
- Strong biometric authentication
While these security measures protect user privacy, they also present challenges for digital forensic investigations.
Android Architecture
Android consists of several key layers:
Linux Kernel
The Linux kernel provides hardware abstraction, process management, memory management, networking, and security controls.
Hardware Abstraction Layer (HAL)
The HAL enables Android software to communicate with device-specific hardware components.
Android Runtime (ART)
ART executes Android applications and manages memory allocation and application processes.
Native Libraries
Libraries provide functionality for:
- Graphics rendering
- Database management
- Media playback
- Encryption
- Application Framework
The framework supplies APIs used by Android applications.
Applications
User-installed and system applications reside at the top layer and generate most forensic artefacts.
Android File System Structure
Important Android directories include /data that includes application data, user information, and databases.
Examples:
- Contacts
- Messages
- Application settings
- User accounts
/sdcard that contains user-generated files such as:
- Photos
- Videos
- Downloads
- Documents
/system that contains operating system files and applications.
/cache that contains temporary system and application data.
Android Digital Forensic Acquisition Methods
Manual Acquisition
Investigators manually examine device contents through the user interface.
Advantages:
- Simple
- Low risk
- Limitations:
- Limited access
- Cannot recover deleted data
Logical Acquisition
Extracts accessible files and databases through operating system interfaces which is fast and causes minimal modification of the device, however, it does not include deletion information.
File System Acquisition
Obtains a complete file system structure including application data and is more comprehensive in the data that is extracted, however, it may require elevated privileges to obtain this extraction type.
Physical Acquisition
Captures a bit-for-bit image of device storage and includes the potential recovery of deleted data as well as information that may not be identified through lower level extractions, including encrypted applications, however, it is increasingly difficult to obtain due to encryption and security updates.
Key Android Digital Forensic Artefacts
Contacts
Contact information is typically stored within SQLite databases and may include:
- Names
- Telephone numbers
- Email addresses
- Contact photos
- Call Logs
- Call records provide:
- Incoming calls
- Outgoing calls
- Missed calls
- Call durations
- Timestamps
These records assist investigators in reconstructing communication patterns.
SMS and MMS Messages
Messaging databases may contain:
- Message content
- Sender and recipient information
- Attachments
- Delivery status
- Timestamps
Deleted messages may sometimes be recoverable.
Application Data
Applications generate significant forensic evidence including:
- Telegram
- Signal
- Facebook Messenger
- Snapchat
Artefacts may include:
- Chat histories
- Shared media
- Contact lists
- Group information
- Voice notes
- Browser Artefacts
Android browsers store:
- Browsing history
- Bookmarks
- Downloads
- Cookies
- Cached content
- Search terms
Common browsers examined include:
- Google Chrome
- Samsung Internet
- Firefox
- Microsoft Edge
Email Artefacts
Email applications may contain:
- Account information
- Message content
- Attachments
- Synchronisation records
Media Files
Images and videos often contain metadata such as:
- Creation dates
- GPS coordinates
- Device model
- Camera settings
This information can assist with timeline reconstruction.
Download History
Download records may reveal:
- Downloaded documents
- Images
- Software packages
- Source URLs
- Calendar Entries
Calendar artefacts may include:
- Appointments
- Meeting invitations
- Reminders
- Locations
- Notes and Documents
Many users store important information in note-taking applications, creating valuable forensic evidence.
Location Artefacts
Android devices generate extensive location information and can be obtained from GPS Data which provides precise geographic coordinates.
Wi-Fi Records
Stored Wi-Fi networks may reveal:
- Frequently visited locations
- Home and workplace information
- Cell Tower Data
Cellular records help establish approximate device locations.
Google Location Services
Depending on user settings, Google services may maintain detailed location histories.
System Logs and Device Information
Android maintains various logs useful for investigations including Event Logs, Record significant device events and Usage Statistics that may reveal:
- Application usage
- Device interaction times
- User behaviour patterns
- Power and Charging Events
Can help establish activity timelines.
Account Information
May identify:
- Google accounts
- Email accounts
- Cloud synchronisation activity
- Deleted Data Recovery
Deleted data may remain recoverable depending on:
- Device model
- Android version
- Encryption status
- User activity after deletion
Potentially recoverable artefacts include:
- Deleted messages
- Deleted photographs
- Removed application data
- Browser history
Modern Android encryption significantly reduces recovery opportunities compared to older devices.
Android Security and Forensic Challenges
Encryption
File-Based Encryption protects user data and limits access without device credentials.
Secure Hardware
Trusted Execution Environments (TEE) and secure elements protect cryptographic keys.
Application Sandboxing
Applications are isolated from one another, making cross-application analysis more difficult.
Remote Wiping
Cloud-connected devices may be remotely erased if not properly isolated.
Frequent Updates
Android’s rapid development cycle requires investigators to continually update forensic methodologies.
Android Evidence in Legal Proceedings
Android evidence is frequently presented in:
- Criminal investigations
- Fraud cases
- Employment disputes
- Family court proceedings
- Corporate investigations
To ensure admissibility, investigators must:
- Maintain chain of custody
- Use validated forensic tools
- Document acquisition procedures
- Preserve evidence integrity
Failure to follow forensic best practices may undermine evidential reliability.
Conclusion
Android has evolved from a small startup project into the world’s dominant mobile operating system. Its widespread use means that Android devices routinely contain valuable evidence relating to communications, internet activity, locations, social media interactions, and user behaviour.
Modern Android devices generate a vast range of forensic artefacts that can assist investigators in reconstructing events and establishing facts relevant to legal proceedings.
However, advancements in Android security, including encryption, sandboxing, and secure hardware technologies, continue to present challenges for forensic practitioners.
As Android evolves, digital forensic investigators must remain current with new operating system versions, acquisition techniques, and artefact locations to ensure accurate and legally defensible examinations.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensic experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years. Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
