A custom recovery approach for physical forensic imaging of android device

Abstract

Physical forensics imaging is part of the acquisition process. It captures all the data on the drive. The problem of forensics investigation on the android device is the acquisition process. It is because the device needs to be rooted for the acquisition. The root process on Android is usually done so that exploration can be carried out on the system. However, it can risk damaging the system itself if done incorrectly. In this paper, we proposed how to do physical forensics imaging on an android device by using the custom recovery (CR) approach. Custom recovery is a recovery environment in Android that can be used to restore the default setting of a system. We developed an application that performs the custom recovery approach. We use the computational thinking method to develop the application. The result of the paper is an application that enables to perform the physical forensics imaging on an android device by generating the hash checksum to ensure the integrity of the result from the physical forensics imaging process.