Comparison on Artifacts Left on Rooted and Non-Rooted Android Devices

This project focuses on the comparative analysis of digital forensic artifacts obtained from rooted and nonrooted Android devices. With the rapid growth of mobile usage, smartphones have become a significant source of digital evidence in forensic investigations. The study aims to evaluate how root access influences the availability, accessibility, and integrity of data artifacts. Data acquisition is performed using Android Debug Bridge on both rooted and non-rooted environments. Various applications such as WhatsApp, Instagram, and Google Chrome are used to generate user activity and corresponding artifacts. In non-rooted devices, only limited user-level data such as cache files, external storage, and logs can be accessed due to operating system restrictions. In contrast, rooted devices provide deeper system-level access, allowing extraction of private application data, databases, system logs, and residual or deleted files. The study also highlights challenges related to data integrity, security restrictions, and potential evidence tampering in rooted environments. The results demonstrate that rooted devices significantly enhance the depth of forensic analysis, while non-rooted devices ensure better data reliability but limited accessibility. This comparison provides valuable insights into selecting appropriate forensic methods for mobile investigation