AbstractThis paper presents a comprehensive analysis of forensic techniques for Android devices, focusing on logical extraction methods and temporary root techniques. As Android smartphones continue to dominate the mobile market, they serve as critical sources of digital evidence in forensic investigations. However, security mechanisms such as application sandboxing, encryption, and file-based access controls pose challenges to forensic data acquisition. Logical extraction techniques provide a non-intrusive approach to retrieving user-accessible data, ensuring evidence integrity while maintaining the device’s operational state. This method is particularly useful for standard forensic investigations where access to unaltered, user-level data is required. Conversely, temporary root methods exploit system vulnerabilities to gain elevated privileges, allowing forensic experts to access deleted and system-level files with minimal modification to the device. This approach is essential for advanced forensic investigations requiring deeper insights into device storage structures. The paper evaluates the strengths and limitations of both methodologies, considering factors such as data accessibility, forensic soundness, and legal admissibility. Additionally, it discusses the evolving landscape of Android security, highlighting challenges introduced by encryption, cloud storage, and anti-forensic techniques. A comparative analysis underscores the importance of selecting the appropriate technique based on investigative needs and device security constraints. The findings suggest that a hybrid forensic strategy beginning with logical extraction and escalating to temporary root techniques when necessary can optimize evidence acquisition while preserving forensic integrity. This study provides forensic practitioners with insights into effective Android forensic methodologies, ensuring comprehensive digital investigations within legal and ethical frameworks.