Freeandroidforensics.blogspot.com Website Review

This blog is a website for me to docu*ent some free Android forensics techniques. With some Linux knowledge (or willingness to learn it), a Windows computer and a Linux computer (or virtual machines), some free software (and I actually mean free, not 30 day trials), and some spare time and motivation to learn, you can do some outstanding work with Android forensics. Check out my Introduction post for more details If you find this blog useful, please consider making a small donation to help me purchase equipment to create more content for this site. I have since learned, well, a lot. If I were to boil down everything I've learned so far, it would be as follows: And as a security person, I am leery of every claim made regarding wireless security. So as you can imagine, this has been quite the learning curve! I wish somebody would write a good guide to this whole parenting thing meant for us computer guys, except I know us computer guys never read manuals. Unless they are short. So on that note, here's a nice short post on obtaining all the user data files from an Android device instead of a physical image. And why WHY WOULD I WANT TO DO SUCH A THING? So in what scenario would you want to skip the process of physically imaging an Android device in lieu of a file system dump? Well first, what exactly am I talking about? A physical image is a file (or set of files) representing the beginning to end of a storage volume, such as a hard drive, or in this case, an Android device. It contains every bit of data, stored just as stored on the device itself. Done properly, a physical image is an A file system dump is a copy of all the files in a specific volume. It contains just files. No deleted records, no slack space, just In Android, all user data is stored in a partition called userdata. If you only had to pick out one area of the device to image, you would pick userdata, every single day. That is where all databases, user activity, installed apps, all app data, and logs are stored. And