Hello Alice 🧩

Right now I'm doing a big and interesting post about surveillance and phones it will come out today/tomorrow .
In the meantime I came across a good article about android forensics.📱

It talks for example about Android metadata analysis

I will tell you briefly about file recovery in different file systems.
In the metadata structure of an Ext4 file system, the inode stores basic information about the file.
When user data is deleted on the Android platform, the deletion time, size and extents tree in
inode structure, can change.
The extode tree is important in terms of data recovery. Because it represents the area where the binary file is stored. A deleted file can be
recover by finding the area where the binary file file is stored through the extents tree and retrieving as much as the file size field.

In the metadata structure of the Ext4 file system, directory entries store the file name, directory size, and sometimes number.
When user data is deleted on , index descriptor and name fields can be removed from directory records.
Sometimes the number is important in terms of recovery because it is used to find the address of the index descriptor where the file information is stored. Deleted files can sometimes be recovered after finding the address, sometimes through a number field, sometimes in a directory entry.
In addition, the name of a deleted file can be recovered through
Name field of the directory entries.

Also in this article there is a parsing of the files and what can be taken out of them (spoiler a lot)

I think many will be interested! That's all, thank you for reading ❤️
And I'm going to go prepare a big post for you.
And remember, if a rabbit looks at the time, he's not always late.
#mobile #android #forensics