Android Partitions and File Hierarchy

To analyse any system you must know its file hierarchy. Knowing how Android organises data in files and folders lets an analyst narrow the search to specific locations.

• The Android file hierarchy is a customised version of the Linux hierarchy.
• It may change slightly with the manufacturer and the underlying Linux version.
• Some folders are visible only with root access.

Android PartitionsSearch on YouTubeBookmarkSaved

Partitions vary from phone to phone, because manufacturers customise Android.

Practical: Viewing Partitions with ADBSearch on YouTubeBookmarkSaved

adb devices                          # list connected devices
adb shell                            # open a shell on the device
cd /proc
ls -al                               # the 'partitions' file is here
cat partitions                       # lists partitions (sda, sdb...) but not what they map to
exit                                 # leave the shell and come back
adb shell
df                                   # filesystem path (alias/mapping) and size info
ls -l $(find /dev/block -name by-name)   # partition name -> block device mapping
cat /proc/partitions                 # partition layout
cat /proc/mounts                     # what is mounted where

cat /proc/partitions shows block devices (for example sda) but not whether sda is data, system or boot. The by-name symlinks under /dev/block give that mapping.

Android File HierarchySearch on YouTubeBookmarkSaved

In Linux the file hierarchy is a single tree. The top of the tree is /, called the root.

Overview of DirectoriesSearch on YouTubeBookmarkSaved

Important Subdirectories of /dataSearch on YouTubeBookmarkSaved

• /data/dalvik-cache: holds optimised dex files so they need not be compiled and loaded each time. When an app is installed, its .dex file is modified and an .odex (optimised dex) file is created. It is cached here so the optimisation does not run every time the app loads. Demo: cd data/, ls -al, cd dalvik-cache, ls -al.
• /data/data: the private data of all applications. Most user data is stored here, so it is very important forensically. Demo: cd data, ls, cd com.android.phone, ls.

/sdcard and DCIMSearch on YouTubeBookmarkSaved

• The SD card can be removable or non-removable storage.
• Any app with the WRITE_EXTERNAL_STORAGE permission may create files or folders here.
• Most phones have default folders such as android_secure, Android, DCIM and media.
• DCIM (Digital Camera Images) is the default directory structure for cameras, smartphones and tablets. It holds photos, videos and thumbnail (cache) files. Photos are stored in /DCIM/Camera.

/system ContentsSearch on YouTubeBookmarkSaved

• build.prop: all build properties and settings for the device. It gives an overview of the device model, manufacturer, Android version, CPU details and more. Demo: cat build.prop.
• app: system apps and preinstalled apps. Mounted read-only to prevent changes. Besides .apk files you see .odex files. An .odex file is a collection of parts of the app optimised before booting, meant to save space.
• framework: sources of the Android framework. Holds implementations of key services, such as the system server with the package and activity managers. Much of the mapping between Java app APIs and native libraries happens here. Demo: cd framework.

Practical: Walking the TreeSearch on YouTubeBookmarkSaved

adb shell
ls -al                     # top-level folders; acct is listed first
cd acct/ ; ls ; cd ..
cd cache ; ls ; cd ..
cd data/ ; ls -al ; cd dalvik-cache/ ; ls -al ; cd ..
cd data ; ls ; cd com.android.phone ; ls ; cd ../../..
cd dev ; ls -al ; cd ..
cat init                   # contents of the init file
cd mnt/ ; ls ; cd ..
cd proc/ ; ls ; cat meminfo ; cd ..
cd sbin ; ls ; cd ..
cd sdcard ; ls ; cd ..
cd system ; ls ; cat build.prop ; cd app ; ls ; cd ../framework ; ls

Most of these need root on a real phone. On an emulator adb root gives a root shell.

Application Data StorageSearch on YouTubeBookmarkSaved

Android apps store a lot of sensitive data. Apps on a device come from four sources:

• Apps that come with Android
• Apps installed by the manufacturer
• Apps installed by a wireless carrier
• Apps installed by the user

App data often holds a wealth of information relevant to an investigation (for example, WhatsApp forensics starts by finding where the WhatsApp package is installed).

• App data can be stored internally or externally.
• On external storage (SD card) data can be anywhere. On internal storage the location is predefined.
• Internal data of every app (system or user-installed) is saved in /data/data/<package name>. For example, the default email app is com.android.email, and its data is in /data/data/com.android.email.

App data can be stored in five places:

1. Shared preferences
2. Internal storage
3. External storage
4. SQLite database
5. Network

Shared PreferencesSearch on YouTubeBookmarkSaved

• A framework to store key-value pairs of primitive data types in .xml format. Primitive types: boolean, float, int, long and string.
• Stored in /data/data/<package>/shared_prefs/, for example /data/data/com.android.email/shared_prefs/.
• View with cat:

cat /data/data/com.android.email/shared_prefs/com.android.email_preferences.xml

<boolean name="account_settings_cc_bcc" value="true" />
<string name="account_name">user@example.com</string>
<string name="account_password">...</string>

• Data is in name-value pairs. Parameters such as account_name, account_password and recent_messages are interesting forensically.
• Many apps store sensitive data in shared preferences because it is lightweight. So it is a key source of evidence.

Internal StorageSearch on YouTubeBookmarkSaved

• Files are stored in the app's /data/data subdirectory.
• Data here is private; other apps cannot access it.
• Even the device owner cannot view these files unless they have root.
• The developer can allow other processes to modify and update these files if needed.
• Most apps get the folders databases, lib, shared_prefs, cache.
• The databases folder holds crucial data. View it with tools such as SQLite Browser.

External StorageSearch on YouTubeBookmarkSaved

• Removable media (SD card) or non-removable storage that comes with the phone.
• A removable SD card can be used on other devices by moving the card.
• SD cards are usually formatted with FAT32, EXT3 or EXT4.
• External storage has no strict security enforcement. Data here is public. Other apps can read it if they have the needed permissions.
• Apps keep large files (images, videos) here for faster retrieval.

SQLite DatabaseSearch on YouTubeBookmarkSaved

• A popular database format for structured data on many mobile systems. Open source, compact, full-featured.
• Android supports SQLite through dedicated APIs.
• App databases are usually at /data/data/<ApplicationPackageName>/databases.
• Highly valuable forensically: they often hold much of the app's important data.

Android FilesystemSearch on YouTubeBookmarkSaved

A filesystem defines how data is stored, organised and retrieved from a volume. A basic installation may use one volume split into several partitions, and each partition can have a different filesystem. Windows uses FAT32 or NTFS; Linux uses EXT2 or EXT4. Examination tools (FTK, Autopsy) extract evidence from an image based on its filesystem.

Purpose of a FilesystemSearch on YouTubeBookmarkSaved

• A directory is a collection of files; files hold data and have extensions.
• To the OS everything is in memory, in binary form.
• The filesystem decides how content is stored in memory and how files are retrieved. For example, it lets the OS open a .docx file with Microsoft Word.
• The filesystem manages the files and folders inside a partition.

Mount Points and VFSSearch on YouTubeBookmarkSaved

• Android uses mount points, not drive letters (C:, E:).
• A mount point is a directory to which a partition is attached.
• Mounting attaches an additional filesystem to the currently accessible filesystem.
• Each filesystem has its own rules, so each offers different retrieval speed, security, size limits and so on.
• From a forensic view, identify which filesystems Android uses and which matter to the case. The filesystem holding user data is the main concern.
• Filesystems are not accessed by drive name. They are combined into one hierarchical tree. Each new filesystem joins this tree when it is mounted, and its files become the contents of the mount-point directory.
• Each filesystem has a kernel module that registers its operations with the Virtual File System (VFS). VFS lets applications access different filesystems in a uniform way.

cat /proc/mounts     # sda, sdb... are partitions; /system, /data are mount points
cat /proc/filesystems   # supported filesystems; 'nodev' marks pseudo filesystems

In /proc/mounts, /system and /data are directories mounted on partitions such as sda and sdb.

Common Android FilesystemsSearch on YouTubeBookmarkSaved

Three main categories:

1. Flash memory filesystems
2. Media-based filesystems
3. Pseudo filesystems

Flash Memory FilesystemsSearch on YouTubeBookmarkSaved

Flash memory is non-volatile memory that is erased and reprogrammed in units called blocks. Flash has special characteristics (long erase times for some blocks), so it needs special filesystems.

Media-based FilesystemsSearch on YouTubeBookmarkSaved

These manage media storage and retrieval.

• EXT2/EXT3/EXT4 (Extended file system): one of the first filesystems to use the virtual filesystem.
  • Journaling is the main advantage of EXT3 over EXT2. After an unexpected shutdown or corruption, EXT3 does not need the filesystem verified; files and folders stay available.
  • EXT4 gained importance with dual-core phones. YAFFS2 had a bottleneck on dual-core systems, so with Gingerbread Android swapped YAFFS for EXT4.
• FAT (FAT12, FAT16, FAT32): supported by the MSDOS driver.
• VFAT (Virtual File Allocation Table): an extension of FAT16 and FAT32.
• Most Android devices support Microsoft's FAT32. Windows, Linux and macOS all support it, so they can read, modify and delete files on the FAT32 part of an Android device. Most external SD cards are formatted FAT32.

Pseudo FilesystemsSearch on YouTubeBookmarkSaved

Pseudo filesystems are logical groupings of files. They have no real storage device and are marked nodev in /proc/filesystems.

cat /proc/filesystems
cat /proc/cpuinfo

Quick self-testSearch on YouTubeBookmarkSaved