In order to perform forensic analysis on any system (desktop or mobile), it's important to understand the underlying file hierarchy. A basic understanding of how Android organizes its data in files and folders helps a forensic analyst narrow down their research to specific issues. (Location 2449)

The following is a list of important folders that are common to most Android devices. Some of the folders listed are only visible through root access. Rooting is the process of gaining privileged access on an Android device. (Location 2459)

/boot: As the name suggests, this partition has the information and files required for the phone to boot. It contains the kernel and Random Access Memory (RAM) (Location 2463)

Data residing in (Location 2465)

RAM is rich in value and should be captured during a forensic acquisition. (Location 2465)

/system: This partition contains system-related files other than the kernel and RAM disk. (Location 2466)

The contents of this partition can be viewed using the following command: (Location 2467)

The Android file hierarchy (Location 2449)

Data… (Location 2465)

RAM is rich in value and should be captured during a… (Location 2465)