Skip to main content

Mobile Forensics – The File Format Handbook

Common File Formats and File Systems Used in Mobile Devices

  • Book
  • Open Access
  • © 2022

You have full access to this open access Book


  • This book is open access, which means that you have free and unlimited access
  • Summarizes knowledge about several file systems and file formats commonly used in mobile devices
  • Includes APFS, Ext4, F2FS, QNX6, SQLite, Property Lists, Realm, Java Serialization, and Protocol Buffers
  • Aimed at digital forensic professionals or students specializing in digital forensics

Buy print copy

Softcover Book USD 49.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book USD 59.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

About this book

This open access book summarizes knowledge about several file systems and file formats commonly used in mobile devices. In addition to the fundamental description of the formats, there are hints about the forensic value of possible artefacts, along with an outline of tools that can decode the relevant data.

The book is organized into two distinct parts:

Part I describes several different file systems that are commonly used in mobile devices. 

·       APFS is the file system that is used in all modern Apple devices including iPhones, iPads, and even Apple Computers, like the MacBook series.

·       Ext4 is very common in Android devices and is the successor of the Ext2 and Ext3 file systems that were commonly used on Linux-based computers.

·       The Flash-Friendly File System (F2FS) is a Linux system designed explicitly for NAND Flash memory, common in removable storage devices and mobile devices, which Samsung Electronics developed in 2012.

·       The QNX6 file system is present in Smartphones delivered by Blackberry (e.g. devices that are using Blackberry 10) and modern vehicle infotainment systems that use QNX as their operating system. 

Part II describes five different file formats that are commonly used on mobile devices.

·       SQLite is nearly omnipresent in mobile devices with an overwhelming majority of all mobile applications storing their data in such databases.

·       The second leading file format in the mobile world are Property Lists, which are predominantly found on Apple devices.

·       Java Serialization is a popular technique for storing object states in the Java programming language. Mobile application (app) developers very often resort to this technique to make their application state persistent.

·       The Realm database format has emerged over recent years as a possible successor to the now ageing SQLite format and has begun to appear as part of some modern applications on mobile devices.

·       Protocol Buffers provide a format for taking compiled data and serializing it by turning it into bytes represented in decimal values, which is a technique commonly used in mobile devices.

The aim of this book is to act as a knowledge base and reference guide for digital forensic practitioners who need knowledge about a specific file system or file format.  It is also hoped to provide useful insight and knowledge for students or other aspiring professionals who want to work within the field of digital forensics. The book is written with the assumption that the reader will have some existing knowledge and understanding about computers, mobile devices, file systems and file formats.

Similar content being viewed by others


Table of contents (9 chapters)

  1. Mobile File System Formats

  2. Mobile File Formats

Editors and Affiliations

  • Agentur für Innovation in der Cybersicherheit, Halle (Saale), Germany

    Christian Hummert

  • Fachgruppe Informatik, Hochschule Mittweida, Mittweida, Germany

    Dirk Pawlaszczyk

About the editors

Christian Hummert is the Chief Scientific Officer of the “Agentur für Innovation in der Cybersicherheit” in Halle, Germany. Prior to this, he was the Director of the Digital Forensics Department at ZITiS and was a Full Professor for IT-Security / Digital Forensics at the Mittweida University of Applied Science. He also is a guest lecturer at the Ludwig Maximilian University (LMU) in Munich. Christian has more than ten years of experience in digital forensics and worked for six years as a practitioner for the police. He led several research and development projects in the field and has taught digital forensics to students and practitioners at different institutions.

Dirk Pawlaszczyk is currently working as a Full Professor in the Department of Computer Sciences, Hochschule Mittweida – University of Applied Sciences. He has published more than 30 research papers in reputed international journals, including Springer and IEEE. His main research work focuseson digital forensics, network security, cloud security and privacy, IoT, distributed simulation, and artificial intelligence. He has ten years of teaching experience and twelve years of research experience.

Bibliographic Information

  • Book Title: Mobile Forensics – The File Format Handbook

  • Book Subtitle: Common File Formats and File Systems Used in Mobile Devices

  • Editors: Christian Hummert, Dirk Pawlaszczyk

  • DOI:

  • Publisher: Springer Cham

  • eBook Packages: Computer Science, Computer Science (R0)

  • Copyright Information: The Editor(s) (if applicable) and The Author(s) 2022

  • Hardcover ISBN: 978-3-030-98466-3Published: 04 May 2022

  • Softcover ISBN: 978-3-030-98469-4Published: 04 May 2022

  • eBook ISBN: 978-3-030-98467-0Published: 03 May 2022

  • Edition Number: 1

  • Number of Pages: XIII, 269

  • Number of Illustrations: 18 b/w illustrations, 173 illustrations in colour

  • Topics: Data Storage Representation, Mobile Computing, Systems and Data Security

Publish with us