Android OS and Data Forensics

Running head: ANDROID OS AND DATA FORENSICS
Android OS and data forensics
Name of the Student
Name of the University
Authors note

1ANDROID OS AND DATA FORENSICS
Introduction
In the mobile device world, the Android OS is predominantly becoming the most used
operating system. The enhancement of technology further has made the mobile devices
become vulnerable to either fall victim or be the tool for victimizing users through
cybercrimes. In the world today, the Digital Forensic Investigators are keener on checking a
mobile device to gather necessary information when a cyber crime has occurred to gather or
cease data. The Android OS devices like a cell phone, a tablet or other devices are the first
ones to be investigated in these kinds of incidents. The following report will put forward the
Data Forensic Investigation techniques and their utilization of the Android OS in these cases.
As the responsibility of a DFI or a Digital Forensic Investigator goes, these people are bound
to go through various advanced and technologically sound devices and they need to be
familiar with the Operating Systems they run on. The predominance of Android OS in the
market leads the DFIs in investigating Android devices every now and then. Thus, the
following report would focus on this phenomenon to assess the understanding of the
commonly used Android OS, the different types in which they are available at including the
classifications of Android malware and the techniques to detect and prevent the malware
functions within the Android devices.
Overview of Android architecture
Basically the Android OS is a modified version of Linux OS. Based on this kernel
new library layer and application framework is developed and implemented so that it can be
compatible with the mobile devices and its hardware architecture. The Linux Kernel is
responsible for managing the network connectivity, device driver functionalities, process
management, and memory management. The operating system is mostly a stack of

2ANDROID OS AND DATA FORENSICS
components which are further roughly divided into four sections and four main layers, such
as, Applications, Application Framework, Libraries and Linux Kernel.
The Linux Kernel lies at the extreme bottom layer with a total of approximately 115
patches. This enables an abstraction level in between the hardware of the devices containing
the essential hardware driver components like the camera, display, keypads and others. This
Kernel also handles the Linux oriented networking and device drivers, making interfacing
much easier to develop a peripheral hardware.
The Libraries are located at the top of the Linux Kernel. There are a set of Libraries
located within the set including the open source web browser engine WebKit, SQLite
Database, library libc, libraries to record and play videos and audios, SSL libraries
responsible for the security of Internet and others. The Java Based libraries are specific to the
development of android OS. In this category, the application libraries are included that adds
to the fact that facilitates the building of user interface, drawing graphics and accessing the
database. The library is added available to an Android developers are android.app,
android.content, android.database, android.opengl, android.os, android.text, android.view,
android.widget, and android.webkit. Other than all these, there is also C and C++ based
libraries that come within the layer of Android software stack.
The Android application Framework layer comes on top of the Android libraries and
this forms the high-level services for the application in form of Java classes. The framework
includes the following key services of an activity manager, content provider, resource
manager, notifications manager and view system. The next layer are the Android applications
which forms the top most layer.