Hoog - Android Forensics: Investigation, Analysis and Mobile Security for Google Android

I now understand that the phrase It takes a village applies equally to writing a book as it does to raising children. As such, I wish to acknowledge the village:

My family (see Dedication).

Lee Haas, for excellent editing and attempts to keep me on schedule

Ted Eull, who coined to term deHOOGification, which provides an immense service to you, the reader, as the ideas bouncing around in my head dont always come out that clear when I persist them to words. Ted is also a great friend and all around swell guy. Many thanks to his better half for her patience in putting up with the long hours racked up by motivated geeks at a tech start-up.

Chris Triplett, for diving head first into Android and doing an amazing job at it. Chris is also excellent at patching drywall and providing some comic relief by applying farm English to digital forensics.

Katie Strzempka, for generally taking care of that other book (iPhone and iOS Forensics). Please buy that one too, seriously.

My parents, Stevie and Al, who set me on the correct path from the start and were always there to remind me if I swerved off a bit.

To Harmonee and Hadabogee, whose help with our daughters, dinner, and other areas is immensely appreciated.

To the men and women who bravely serve the public interest in Local, State, and Federal law enforcement and other government agencies. We appreciate all that you do to protect and serve our communities and countries.

To Google, for seeing the value in Android and creating a new paradigm of openness for mobile devices.

To Apple, for providing the opposite paradigm.

And finally to the reader. I hope that you find this book useful and certainly do appreciate your support.

The Android mobile platform has quickly risen from its first phone in October 2008 to the most popular mobile operating system in the world by early 2011. The explosive growth of the platform has been a significant win for consumers with respect to competition and features. However, forensic analysts and security engineers have struggled as there is a lack of knowledge and supported tools for investigating these devices. This book seeks to address issues not only by providing in-depth insights into Android hardware, software, and file systems but also by sharing techniques for the forensic acquisition and subsequent analysis of these devices. For readers with limited forensic experience, this book creates step-by-step examples that use free, open source utilities so the reader can directly participate in the examples. As the free Android software development kit provides a full Android emulator, readers do not even need to possess an Android device.

As Android devices grow in numbers, an increased awareness of the data they possess will equally grow. Unfortunately, much of that interest will come from cyber criminal organizations who realize that successful attacks against the platform will yield significant results as the devices contain enormous quantities of personal and business information. The solution to this threat requires a deep understanding of the platform not only from core Android developers and manufacturers but also from app developers and corporate security officers. More secure apps will prevent loss of sensitive information as well as strong policies that can be put in place by IT security managers.

Although most of the discussed statistics about Android focus on smartphones and now tablets, there are many more devices that currently or in the near future will run Android. Some examples include vehicles, televisions, GPS, gaming devices, netbooks, and a wide variety of other consumer devices. Android will be present in an increasingly significant percentage of investigations for both forensic analysts and security engineers. Finally, the appeal of Android is not specific to any particular country or region and as such will impact individuals, corporations, and agencies throughout the world.

The following paragraphs contain a brief summary of each of the chapters.