Chapter 11. Android App Analysis and Overview of Forensic Tools

Third-party applications are commonly used by smartphone users. Android users download and install several apps from app stores such as Android Market and Google Play. During forensic investigations, it is often helpful to perform an analysis of these apps to retrieve valuable data and to detect any malware. For instance, a photo vault app might lock sensitive images present on the device. Hence, it would be of great significance to have the knowledge to identify the passcode for the photo vault app. While the data extraction and data recovery techniques discussed in earlier chapters provide access to valuable data, app analysis would help us to gain information about the specifics of an application, such as preferences and permissions. This chapter covers the techniques to reverse engineer an Android application and also throws light on some available forensic tools that may be extremely helpful during forensic acquisition...