When we talk about root access, why do users want root?
Think about it.
Why do users want root?
Most people don't.
They're like, I'm not getting root.
I've read that malware can hit my device if I have root on it.
I know that it could void my warranty,
and I paid 1,000 US dollars for this phone.
There are different reasons why users used to want root.
It was the cool thing to do.
If you had an Android, why would you not root it?
It was open-source.
You could get access to it.
You could do all kinds of things with it.
I only root my test devices.
I never root my own phone because I know
it makes it more susceptible.
An Android device that is fully patched and up to the latest
OS version is one of the most secure devices out there.
And I feel like Android has such a bad reputation for malware,
and it's because a lot of the versions are old,
and the devices aren't upgradeable,
which we talked about in Section 1.
Why do examiners want root?
We want root because it gives us the keys to the kingdom.
If we have root access, we can pull that data partition.
We can pull all the user database files.
We can get a full file system acquisition
or a physical extraction depending on the encryption
that's on that device.
Now, how do you know if a device is rooted?
There are a few different things you can do.
You can open an ADB shell and see if you have a dollar sign
or if you have a pound symbol.
If you have the hashtag or pound symbol, you have root.
You could do what we did in Lab 1.4.
You could look for traces of root.
You could look for installed applications.
One thing I caution you on--
do not rely on your forensic tool
to alert you if root is enabled.
Often, they don't go through and scan for the root first.
You may have to outsmart your forensic tool
and do that in advance of the acquisition.