In this episode, Michal Rozin, R&D Application Researcher in the Decoding Team at Cellebrite, will talk about Android memory images and what they may contain.

Michal will discuss a proof of concept that was conducted regarding RFID and leveraging Android RAM. Topics raised during the podcast will include:

  • The value to digital intelligence memory forensics can provide
  • Different types of extraction methods currently being deployed.
  • Insightful data that was found during the proof of concept.

She will also demonstrate a new feature used for the memory dumps and explain the difference between “Persistent Storage” that stores caches, configuration files, and logs (Figure 1 below) versus “Non-specific Storage” that stores temporary data in run-time (Figure 2 below).

Figure 1

Figure 2

Michal will start by presenting an overview of the storage mechanisms and then cover RAM and decrypted data aspects within Android memory.

Find out more about Android memory images during the podcast.

Share this post