Hi i am majoring in BSc, so my final year project i have decided to do android forensic. One of part is about retrieving deleted information from android device. Is it possible to retrieve content from unrooted Android device?
Thank you
I was able to recover deleted pictures and ring tones from an unrooted HTC Incredible using WinHex.
Hi,
Thank you for your input. I am looking into winHex
Much data are stored within sql databases. So it might to think about parse SQL db & retrieve informations within these db … Andrew GHoog has written a book about Android Forensics Investigation, Analysis and Mobile Security for Google Android.
Hi i am majoring in BSc, so my final year project i have decided to do android forensic. One of part is about retrieving deleted information from android device. Is it possible to retrieve content from unrooted Android device?
Thank you
Without rooting you won't get much from the data partition, where most of the interesting data is located. If you can read the data partition you can examine the sqlite databases which contain calls, sms, contacts and all the apps for deleted content.
Recovering deleted files is possible for instance if the device uses the yaffs2 file system. But the problem is of course how to dump the device. I think rspishock is talking about deleted files on the flash drive, which is much easier of course.
an excellent point, "But the problem is of course how to dump the device."