Storage areas on mobile devices with the android operating system and their relevance in digital forensic analysis

Abstract

The increasing digitalization of society has significantly transformed communication, work, and social interaction, making mobile devices, especially those running Android, central to daily life. These devices store large volumes of personal, professional, and sensitive data, making them frequent targets of cybercrime and privileged sources of digital evidence in criminal and civil investigations.

This article aims to identify and examine the main storage areas on Android devices relevant to digital forensic analysis. To this end, the operating system architecture is characterized, and the most significant partitions for evidence collection are described, with emphasis on /data and /sdcard. Additionally, the Portuguese legal framework relevant to digital evidence is addressed, including the Code of Criminal Procedure, the Cybercrime Law, and data protection legislation, with special emphasis on the principles of authenticity, integrity, and chain of custody. The methodology adopted combines a review of technical and scientific literature and normative analysis with practical use through a case study.

This study centers on the recovery of deleted WhatsApp messages in the context of domestic violence, demonstrating the importance of digital forensics in reconstructing facts, protecting victims, and holding perpetrators accountable.

It concludes that forensic analysis of Android devices is highly complex and requires certified tools, rigorous procedures, and specialized knowledge. The combination of technical skills and the legal framework is essential to guarantee the admissibility, reliability, and soundness of digital evidence, helping ensure the effectiveness of justice and the protection of fundamental rights in the digital age.