Digital Evidence · Topic 3 of 8
Mobile Device Architecture and Acquisition
Learn Android and iOS architecture and boot, mobile storage and evidence locations, acquisition methods, file systems, rooting and jailbreaking for CHFI.
- 5 min
- Android boot: boot ROM, bootloader, kernel, init, Zygote, system_server.
- iOS boot: Boot ROM, LLB, iBoot, XNU kernel, each stage signed.
- Logical acquisition is fastest but skips deleted data. Physical gets it.
What it is
A mobile device is a layered system: hardware, a secure boot chain, an operating system, frameworks and apps. Evidence sits in app databases, system files, the SIM and cloud backups. How you acquire it depends on the device state, the operating system version and whether it is locked.
The exam asks about the layers, the boot chain, where data lives and which acquisition level fits a situation.
How it works
Layers of the mobile environment
From the bottom up: hardware (processor, radio, storage, sensors), operating system and kernel, middleware and runtime, application framework, and applications. Data and permissions are separated by app sandboxes.
Android stack and boot
The Android stack has the Linux kernel at the base, a hardware abstraction layer (HAL), the Android Runtime (ART) and native libraries, the Java API framework, and system and user apps.
Boot sequence: boot ROM, bootloader, Linux kernel, init, Zygote (which forks app processes), system_server, then the launcher. Key partitions are boot, system, vendor, userdata, cache and recovery. User data sits in userdata (/data).
iOS architecture and boot
iOS has four layers: Core OS, Core Services, Media and Cocoa Touch. Boot is a chain of trust: Boot ROM, low level bootloader (LLB, on older devices), iBoot, then the XNU kernel. Each stage verifies the next signature. DFU mode and recovery mode are special states used for restore and, in some cases, acquisition.
Storage and evidence locations
| Item | Android | iOS |
|---|---|---|
| App data | /data/data/package name, SQLite databases | /private/var/mobile/Containers, app sandboxes |
| Messages | App databases such as mmssms.db, depending on version | sms.db in /private/var/mobile/Library/SMS |
| Media | /sdcard or /storage, DCIM | /private/var/mobile/Media, DCIM |
| Shared secrets | Keystore | Keychain |
| Backups | Cloud backups | iTunes or Finder backups, iCloud |
Databases are mostly SQLite. Deleted records may survive in unused pages, journal files or write ahead logs.
Mobile phone evidence analysis
Typical items: contacts, call logs, SMS and chat messages, email, browser history, photos with EXIF location, Wi-Fi networks, location history, installed apps and their data, calendar entries and cloud account tokens. Analysis correlates timestamps across sources and checks time zones and clock formats.
Data acquisition methods
| Method | What it gets | Notes |
|---|---|---|
| Manual | What is shown on screen, photographed | Last resort, no deleted data |
| Logical | Files and data through the operating system, such as backups | Fast, no deleted data in most cases |
| File system | Full file system view, including databases | May need an exploit or elevated access |
| Physical | Bit for bit image of storage | Gets deleted data. Needs hardware or low level access. |
| Chip off, JTAG | Direct reads of memory chips or test ports | Advanced, may damage the device |
General acquisition terms also apply. Live acquisition captures a running system, dead acquisition works on a powered off one, and a bit stream image copies every sector, while a logical image copies selected files.
Before acquiring, keep a phone from receiving new data: put it in a Faraday bag or use airplane mode when the device is unlocked. A powered on, locked device should be kept powered. Always record the state and hash the output.
Android and iOS file systems
| Platform | File systems |
|---|---|
| Android | ext4 and F2FS on internal storage, older devices used YAFFS2. FAT or exFAT on SD cards. |
| iOS | HFS+ on early versions, APFS on modern versions |
Rooting and jailbreaking
Rooting gives full administrator access on Android, usually by unlocking the bootloader and installing a root tool. Jailbreaking removes iOS restrictions. Jailbreaks are classed as tethered, semi tethered, semi untethered or untethered by how they behave after a reboot.
For an investigator, root or jailbreak access can enable a deeper extraction, but it changes the device. It must be documented and justified. A device that was already rooted or jailbroken by its owner may carry unvetted software and weaker protections.
A worked example
An unlocked phone is seized from a suspect. The investigator places it in a Faraday bag, then, in a controlled step, enables airplane mode, disables auto lock and runs a logical acquisition with a forensic tool.
The tool reports the acquired data and its hash. The investigator also records the device model, build number and date. If a full file system extraction is later needed, the added access is documented.
How the exam asks about this
- "Which Android component forks every app process?" → Zygote.
- "Which acquisition type recovers deleted data from storage chips?" → Physical acquisition.
- "Which iOS boot stage follows the Boot ROM and low level bootloader?" → iBoot.
What to remember for the exam
- Android boot: boot ROM, bootloader, kernel, init, Zygote, system_server.
- iOS boot: Boot ROM, LLB, iBoot, XNU kernel, each stage signed.
- Logical acquisition is fastest but skips deleted data. Physical gets it.
- Mobile app data is mostly SQLite.
- Isolate the device from networks to stop remote wipe and new data.
Do not power cycle a locked phone without a plan. Some devices lose a state that makes extraction possible until the first unlock.
Common mistakes
Mixing the Android and iOS boot chains. Zygote and init belong to Android. iBoot and DFU belong to iOS.
Treating jailbreaking as harmless. It alters the device and must be recorded.
Leaving the phone connected to the network. A remote wipe command or new messages can change the evidence.
Check yourself
Which layers form the iOS architecture?
Core OS, Core Services, Media and Cocoa Touch.
Which acquisition level can recover deleted records?
A physical (or full file system) acquisition, because it reads storage below the normal operating system view.
Why is a phone placed in a Faraday bag?
To block cellular and wireless signals so it cannot receive remote wipe commands or new data.
Topic 3 of 8 in Digital Evidence
Test yourself on Digital Evidence
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.