Using any of the screen lock bypass techniques explained in Chapter 8, Android Forensic Setup and Pre-Data Extraction Techniques, an examiner can try to access a locked device. Once the device is accessible, the next task is to extract the information present on the device. This can be achieved by applying various data extraction techniques to the Android device. This chapter will help you to identify the sensitive locations present on an Android device and explain various logical and physical techniques that can be applied to the device in order to extract the necessary information.
In this chapter, we will cover the following topics:
- Logical data extraction using ADB pull, ADB backup, ADB dumpsys, and content providers
- Physical extraction, which covers imaging an Android device and SD card, JTAG, and chip-off techniques
