Android File Hierarchy

/boot Information and files needed for boot; containts

kernel and RAM disk
/system Contains system files other than kernel and RAM
disk; should never been deleted as the device will
be unbootable
*/recovery Backup purposes and allows the booting into
recovery mode
/data Data of each application; data belonging to user
such as contacts, SMS, dialed numbers, etc
*/cache Stores frequently accessed data and some logs for
faster retrieval; important to forensic
investigations as data residing may no longer be
present in /data partition
*/misc Contains information about miscellaneous
settings; settings define state of the device – on or
off- hardware settings, USB settings, etc.; accessed
from folder
/sdcard Holds all information present on the SD card;
contains pictures, videos, files and documents, etc.

Important File systems

Significant to
Investigation?
Root file system (Rootfs) Contains information required
to boot; if this file system is
corrupted, device cannot be
booted
Sysfs mounts/sys folder which No
contains information about the
configuration of the device;
Devpts Presents an interface to the No
Terminal session on the device;
mounted at /dev/pts
Cgroup Control groups; tracks the job of No
Android devices; not very useful
for forensic analysis
Proc Information about kernel data Yes
structures, processes, and
system-related information in
the /proc directory;
Tmpfs Temporary storage facility that Yes
 stores RAM (volatile memory);
Common File Systems
EXT4 Fourth version of the extended
file system; significant in devices
with dual-core processors
VFAT Extension of the FAT16 and
FAT32 file systems; SD cards are
formatted using the FAT32
version
YAFFS2 (Yet Another Flash File Open source single-threaded file
System 2) system that is fast and deals with
NAND flash; log-structured file
system; not supported by newer
kernel versions
(F2FS) Flash Friendly File Supports Samsung devices
System running Linux 3.8 kernel; log-
structured methods that
optimizes NAND flash memory
Robust File System (RFS) Supports NAND flash memory on
Samsung devices and is a FAT16
or FAT32 file system where
journaling is enabled through
transaction logs

Source: Practical Mobile Forensics Third Edition, Tamma,R., et. al