Abstract
Portable devices, such as those that run Android, allow people to do much more than ever before. Users of these devices can receive and respond to email when away from their computers. Pictures taken on GPS enabled devices can store location data, so users know where a picture was taken. Users can take a picture and immediately upload it somewhere. Specialized third-party apps extend the functionality of these devices even further, adding to the types of data being used and stored on the device. With all this new data comes risk. Because data can be stored, it can also be retrieved. This project covers many types of data acquisition methods for an Android device, to determine what information can be retrieved. All of the methods were free to use, and could be used by an untrusted third-party, such as a thief. Data was acquired from a T-Mobile G2x, an Android smartphone, consisting of data created for the project, as well as data that already existed on the device. The data consisted of: email messages, text messages, a phone call log entry, pictures, a calendar event, location data, a Skype instant message, a Facebook Post, and an Evernote note. An email message, two text messages, and two pictures, were deleted to determine if these could be recovered. Using the various methods used in this project, most of the data was retrieved. Portable devices are susceptible to being lost or stolen. Because of this and the results of this project, where confidentiality is warranted, additional security measures should be taken to protect the data.