Comparison on Artifacts Left on Rooted and Non-rooted Android Devices
Year: 2026
Type: article
Abstract: This project focuses on the comparative analysis of digital forensic artifacts obtained from rooted and nonrooted Android devices. With the rapid growth of mobile usage, smartphones have become a significant source of digital evidence in forensic investigations. The study aims to evaluate how root access influences the availability, accessibility, and integrity of data artifacts. Data acquisition is performed using Android Debug Bridge on both rooted and non-rooted environments. Various applications such as WhatsApp, Instagram, and Google Chrome are used to generate user activity and corresponding artifacts. In non-rooted devices, only limited user-level data such as cache files, external storage, and logs can be accessed due to operating system restrictions. In contrast, rooted devices provide deeper system-level access, allowing extraction of private application data, databases, system logs, and residual or deleted files. The study also highlights challenges related to data integrity, security restrictions, and potential evidence tampering in rooted environments. The results demonstrate that rooted devices significantly enhance the depth of forensic analysis, while non-rooted devices ensure better data reliability but limited accessibility. This comparison provides valuable insights into selecting appropriate forensic methods for mobile investigation
Author: Abirami. A, Ms.SNEHA
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7164916957
FWCI:
Cites:
Cited by:
Related to: