What is Android ADB with smartphone forensics?

Written by Amber Schroader

October 5, 2021

There is a lot of trust put into your digital forensic tools when it comes to processing data. Many times, the “magic” of the tool remains someone unknown to the end-user. Each company claims to have a special means to capture the data that is seen in the acquisition. However, what is unsaid by tool manufacturers is that often the same foundational methods are used with all tools.

The perfect example is with iOS devices. All the manufacturers, when working with iOS, have limited options when communicating and capturing data from the device. It is why you will see consistent image data from one tool to another. The true “magic” with iOS comes in the tool’s ability to parse and understand the data that is captured. This is true with all types of images done by smartphone forensic tools and the ability to effectively parse should be a significant buying point when selecting a tool.

Another example of consistency seen with smartphone forensic tools comes with Android ADB.  Android ADB, or Android Debug Bridge, is a command-line tool that allows communication with an Android device. It is included in the Android SDK Platform-tools and can be downloaded separately from the Android developer website. All Android OS devices despite the manufacturer have the ADB service in the device. Therefore, for smartphone forensic tools this is a consistent path used to process a forensic image of the device.

So, what does ADB do for your forensic tools?

  • Get a wide range of device info and properties, i.e., serial number, model, etc.
  • Force the device into recovery, fastboot, or bootloader mods.
  • Explore available file system artifacts.
  • Gather specific data.
  • Make device backup that is generally used in logical data extraction.
  • Create device screenshots or recordings.
  • Obtain device logcat.

The value of the ADB process is obvious with the access that it allows being able to capture valuable Android data. However, the capture is only the first step in the process. Many ADB tools impose some restrictions that make the investigation process inconvenient, for example:

  • ADB requires specific knowledge of the command-line tool and its commands.
  • A created device backup is stored in the ab format that requires additional utilities to unpack the content.
  • Representation of the device file system artifacts lacks details in the ADB console.
  • There is no guarantee that data transferred from a device won’t be modified.

This is where you should be asking your tool manufacturers how they are using ADB and managing some of the above-mentioned issues that can exist.

With the Paraben E3 Forensic Platform, the ADB communication is used to open the communication path to the Android device. Then the E3 Forensic Platform uses this path to allow for a unique root privilege ADB communication to capture the data. Once the capture is complete the unique ADB command is removed from the device and it is returned to its original state. This type of method allows for a more forensically sound transfer of data from the device with a higher level of access to the device data.

Other tools capture the raw ADB file, and their tool is used as a parsing engine to recover the data from the image. When looking at the ADB process in most tools there are two core areas that should be questioned and evaluated.  First, how are they using ADB to avoid some of the issues that are mentioned above, and second how is their parsing of the raw ADB captured data?  With many of the smartphone forensic tools using the same methodology it quickly becomes clear that the value of quality data parsing becomes a significant factor when evaluating different tools and making a purchasing decision.

To learn more about the general evolution of Android.


smartphone forensic training
smartphone forensic training

Forensic-Impact Articles

How to get started in the field of digital forensics

How to get started in the field of digital forensics

When you think of different career paths in the field of cyber you might not always notice the field of digital forensics. However, if you have a passion for all things digital and keen attention to detail this field could be the perfect place for you where a job is...

Expectations of Facebook Data

Expectations of Facebook Data

As social media continues to rise so does the power of Facebook. If you are not on it personally you are for your business or to connect with people on a hobby. That being part of the Meta universe has become as essential as getting a driver’s license. So, what does...

EMI Shielding & Why You Need It

EMI Shielding & Why You Need It

The topic of Physics may not be the first thing that comes to mind when you think of digital forensics, but it does play a key role in the preservation of your digital evidence. Not every organization is lucky enough to have their lab so isolated that they get no...