What is the MAIN difference between a Full Root and a Shell/Soft Root?

The main difference between a Full Root and a Shell/Soft Root is persistence. A Full Root, also known as a permanent root, involves modifying the device's /system partition to install the su binary and a superuser management application. Because these changes are made to a core, persistent partition, the root access survives device reboots. Conversely, a Shell/Soft Root is a temporary method that exploits a vulnerability to gain elevated privileges for the current session only. It does not make permanent modifications to the /system partition, and therefore, root access is lost as soon as the device is restarted.

B: Both rooting methods can leave forensic traces; a full root is simply more overt due to permanent system modifications. C: Both methods ultimately provide system-level (root) access. The defining difference is how that access is achieved and whether it persists. D: This statement is tautological. A "Shell root" is a specific type of "soft root," not a feature that distinguishes it from a "full root."

1. Andriotis, P., & Li, V. O. K. (2014). A survey on android rooting: Risks, techniques and detection. In 2014 IEEE 11th Consumer Communications and Networking Conference (CCNC) (pp. 972-977). IEEE. In Section III-A, "Rooting Techniques," the paper distinguishes between "Temporary root" (equivalent to soft/shell root) which is lost on reboot, and "Permanent root" (equivalent to full root) which involves modifying the /system partition and persists across reboots. (DOI: 10.1109/CCNC.2014.6866692)

2. Vidas, T., & Christin, N. (2014). Evading Android Runtime Analysis with Split Personalities. In Proceedings of the 7th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec '14). Association for Computing Machinery, New York, NY, USA, 149–160. The paper discusses rooting mechanisms, noting that permanent rooting involves "placing the su binary in /system/bin or /system/xbin," which ensures persistence. It contrasts this with temporary methods that do not alter the /system partition. (DOI: 10.1145/2627393.2627400)

3. University of New Haven. (n.d.). Lecture 3: Android File System & Data Acquisition. Courseware for UNH-CS6620-AndroidForensics. The lecture materials explicitly differentiate rooting types, defining temporary root as access that is lost upon reboot and permanent root as access that modifies the /system partition and persists through reboots. This distinction is fundamental to forensic acquisition strategies.