In summary, Android is really difficult.
It is probably going to be the hardest
device you are going to work because there are so
many differences.
Apple is very restrictive and controlling
and actually makes forensic analysis a lot easier.
Expect to have problems during extraction.
Expect to have issues with encryption.
Remember, advance logical could be your best evidence.
But it also could be your best link to all those identifiers.
Make sure you ask for cloud if you can, and explain why.
If you're missing location artifacts or pieces
of the puzzle from the device, I guarantee, Google Cloud has it.
Make sure you are aware for every single flavor of Android.
And the reason I say that--
as you can see here, stats show it
takes an average of 2.5 years for people
to catch up on average to the latest versions
because the updates are controlled
by the manufacturer of the device and your network service
provider.
So be very careful with assuming you're only
going to see Android 12.
I talk to people all the time.
They're like, oh, I have an Android 5 device.
I have Android 4.
The older ones are actually easier.
Be grateful if you are seeing older Android
devices because they have full-disk encryption, at best.