0 Android 7/ 1077 Android 7/LG GSM_H790 Nexus 5X.ufd 31268536320 Android 7/blk0_mmcblk0.bin 399134 Android 7/Android7-ImageCreationDocumentation.pdf 4194304 Android 7/blk32_mmcblk0rpmb.bin 9021 Android 7/procdata.zip 17076 Android 7/Android 7 Hashes.pdf 244453 Android 7/Takeout Data/Snapchat - thisisdfir/mydata~1543946597209.zip 17122745 Android 7/Takeout Data/Google - thisisdfir(at)gmail.com/takeout-20181204T161119Z-001.zip 17580 Android 7/Takeout Data/WhatsApp - 919-758-0276/access.html 1584 Android 7/Takeout Data/WhatsApp - 919-758-0276/portability.json 121022 Android 7/Takeout Data/Instagram - thisisdfir(at)gmail.com/thisisdfir_20181204.zip 426490 Android 7/Takeout Data/Twitter - (at)TDfir/twitter-2018-12-04-1fbea4f27668f929a907214ff59b0709576b2bae541a44c9b4ad2fa15062dfaf.zip 4027833 Android 7/Takeout Data/Facebook Messenger - 919-758-0276/facebook-100030861781799.zip
You can download Android 7 from: http://downloads.digitalcorpora.org/corpora/mobile/android_7.tar.gz
Additional information appears below:
Android Image Information
As of October of 2018, Android 7 (Nougat) is the most popular version of Android in use today (28.2%), and, as such, it is important that the digital forensic community understand its inner workings; it would be ideal to have a Nougat image with strong documentation to widely available to the digital forensic community to use for research, education, and training. To help with this initiative, we are presenting an image of Android 7 (Nougat) populated with documented data over a period of seven days. This image is freely available to the digital forensic community.
The image is in a binary format and can be examined in numerous digital forensic tools.
The following files are included with the image:
- Documentation of the contents of the image. The information in this document represents the known actions taken with the device during the testing period, along with information about the test device itself.
- blk0_mmcblk0.bin and blk32_mmcblk0rpmb.bin
- The image files in binary format.
- Documented hash values of the image files and the pocdata.zip file.
- LG GSM_H790 Nexus 5X.ufd
- UFED file generated as a result of the extraction process. This file can be used to open the image in Cellebrite’s Physical Analyzer application. Opening this file in Windows Notepad or similar application provides information about the extraction.
- A zip file that contains metadata about the extracted partitions of the device and hardware components of the test device.
- Takeout Data
- A folder that contains takeout data from the electronic service providers (ESPs) that offered takeout services. The ESPs represented in this folder are those who’s apps were used on the device.