## 1 Introduction  
In recent years, our society has experienced an accelerated process of computerization, thus becoming highly interconnected. In May 2019, in Brazil alone, public records pointed to over 230 million smartphones in use. If we add up laptops and tablets to that number, there were then 324 million portable devices, i.e., approximately 1.6 portable devices per inhabitant [1]. With the evolution of mobile devices, a large part of the population has been replacing the computer by the smartphone to perform most tasks involving technology, for example, exchanging messages, sending e-mails, making online payments, etc. According to the StatCounter (Web traffic analysis website) [2], smartphones account for 51.69% of computing devices (smartphones, tablets, and computers) in use worldwide. Mobile devices are used for a variety of tasks, such as sending or receiving text or voice messages, images, chatting by voice or video calls, watching videos, sending or receiving e-mail, making bank transactions, capturing and manipulating images, using applications for health care, relationships, social networks, monitoring of physical activities, mobility and traffic and even to store and display digital documents. In Brazil, we can mention as an example some government services applications of interest to the citizen, such as the Voter Card, the Vehicle Registration and Licensing Certificate, and the National Driver's License. With technological advances, it has become common for mobile devices to receive constant hardware and software improvements. With each new device launched, a new System on Chip (SoC) is employed, which is more modern, faster, and more energy-efficient, in addition to expanding storage capacity. New mechanisms to protect against unauthorized access are also frequently implemented or improved. Numerous manufacturers already produced cell phones and marketed them globally before the appearance of the Android operating system (OS). After that, they started to invest in hardware development so that their devices started to run the new OS. New manufacturers have also emerged, focusing on the global market or the Asian market, whose consumer public has quite significant numbers. South Korean Samsung is the manufacturer that holds the largest share of the global mobile device market [3] and runs the Android OS, making it the most widely used OS worldwide [4]. Even before the Android OS became the most used OS, this system has been considered an important source of information. As remarked by [PERSON] et al. [5], Android OS constitute a large repository of information in a forensic perspective, both on-site as well as provided remotely. Modern mobile devices are a rich source of data that can be forensic evidence in investigation processes and security analysis. Such devices increasingly have more storage space, connectivity options, and multitask ability, making them the first option for countless users. Currently, devices that run the Android OS and its variations are more accessible in the global market. That turns them into natural candidates in forensic analysis and investigation processes. When it comes to security and digital forensics, analysts strive to acquire and analyze data from mobile devices. The diversity of technology used on mobile devices, the accumulation of digital evidence, the lack of standardized extraction methodologies, and the lack of necessary training characterize challenges that hinder or prevent data acquisition [6]. Companies that develop technologies for digital forensics are also affected by the diversity of components and manufacturers of mobile devices, as they cannot be effective and efficient in all models or in all manufacturers. The gaps left by such companies are also a barrier to law enforcement forces. Files stored in digital format are considered digital evidence, including audio, video, and image files, and even the software or the hardware itself.