Awesome

Android Forensics References

Last update: September 6th 2022 <h1>USERDATA Partition</h1> <h2 style="text-align: left;">"/log" folder</h2> <div> <ul> <li>/log/wifi/iwc/iwc_dump.txt</li> <li>/log/netstats</li> <li>/log/batterystats</li> <ul> <li>Cellebrite CTF 2021 - Heisenberg's Android <a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a> </li> <li>Artefacts of Android device power off due to depleted battery <a href="https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery">https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery</a></li> </ul> <li>/log/recovery</li> <li>/log/sdp_log</li> <li>/log/thermal_log</li> <li>/log/power_off_reset_reason.txt</li> <ul> <li>Cellebrite CTF 2021 - Heisenberg's Android <a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li> <li>Artefacts of Android device power off due to depleted battery <a href="https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery">https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py</a></li> </ul> </ul> </div> <h2 style="text-align: left;">"/misc" and "/misc_de" folder</h2> <div> <ul> <li>/misc/adb/adb_keys</li> <ul> <li>aLEAPP plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py</a></li> </ul> <li>/misc/bluedroiddump/mainBuffer.log</li> <li>/misc/bluedroiddump/subBuffer.log</li> <li>/misc/bluedroid/bt_config.conf</li> <ul> <li>How Android Bluetooth Connections Can Determine If The Hands of a Driver Were On The Wheel During An Accident <a href="https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/">https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/</a> <a href="https://dfir.pubpub.org/pub/6ysxvhvc/release/1">https://dfir.pubpub.org/pub/6ysxvhvc/release/1</a></li> <li>Android Bluetooth Connection Configuration <a href="https://www.stark4n6.com/2021/06/android-bluetooth-connection.html">https://www.stark4n6.com/2021/06/android-bluetooth-connection.html</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2015 <a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> <li>Cellebrite CTF 2021 Writeup <a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a> </li> <li>Cellebrite CTF 2021 - Heisenberg's Android <a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li> <li>Cellebrite CTF 2022 - Heisenberg's Android <a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li> <li>aLEAPP plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py</a></li> </ul> <li>/misc/bootstat/</li> <ul> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py</a> <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py</a></li> </ul> <li>/misc/wifi/qtables.json</li> <li>/misc/wifi/wpa_supplicant.conf /misc/wifi/WifiConfigStore.xml /misc/apexdata/com.android.wifi/WifiConfigStore.xml</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2015 <a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> <li>Cellebrite Fall 2020 CTF - Part 1 - Tony Mederos <a href="https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html">https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html</a></li> <li>Clockin’ In with Google’s Wear OS <a href="https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/">https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/</a> </li> <li>Learning Android Forensics - Second Edition <a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore.py</a> <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py</a></li> </ul> <li>/misc/wifi/softap.conf /misc/apexdata/com.android.wifi/WifiConfigStoreSoftAp.xml</li> <ul> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Let's solve challenges - Cellebrite 2022 CTF Writeup <a href="https://www.dfirblog.com/cellebrite-2022-ctf-writeup/">https://www.dfirblog.com/cellebrite-2022-ctf-writeup/</a></li> <li>Cellebrite CTF 2022 - Heisenberg's Android <a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li> https://www.dfirblog.com/cellebrite-2022-ctf-writeup/ <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> <li>/misc_de/0/apexdata/com.android.permission/runtime-permissions.xml</li> <ul> <li>Android’s “Dangerous” Permissions <a href="https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/">https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/</a></li> <li>Examining A Malware-Infected Android Phone. This Android Is Not Alright. <a href="https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/">https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py</a></li> </ul> <li>/misc_de/0/apexdata/com.android.permission/roles.xml</li> <ul> <li>Android - Roles and Permissions (Android 10/11) <a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py</a></li> </ul> </ul> <div> <h2 style="text-align: left;">"/property" folder</h2> <div> <ul> <li>/property/persistent_properties</li> <ul> <li>aLEAPP plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py</a></li> </ul> </ul> </div> </div> <div> <h2 style="text-align: left;">"/system", "/system_ce" and "/system_de" folders</h2> </div> <div> <ul style="text-align: left;"> <li>/system/appops/ </li> <ul> <li>Snooping on Android 12’s Privacy Dashboard <a href="https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/">https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py</a></li> </ul> <li>/system/batteryusagestats/</li> <li>/system/job/jobs.xml</li> <li>/system/netstats/</li> <ul> <li>Burn After Reading: Expunging Execution Footprints of Android Apps <a href="https://lijuanru.com/publications/nss18.pdf">https://lijuanru.com/publications/nss18.pdf</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> </ul> <li>/system/procstats/</li> <ul> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> </ul> <li>/system/sync/accounts.xml</li> <ul> <li>Who is the owner of the mobile device? <a href="https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/">https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/</a> </li> <li>Clockin’ In with Google’s Wear OS <a href="https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/">https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/</a></li> <li>Super Sunday Funday Forensic Challenge - Update 4 <a href="https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html">https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> <li>/system/shutdown-checkpoints/</li> <ul> <li>Shutdown Checkpoints in Android 12 <a href="https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html">https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py</a></li> </ul> <li>/system/users/0.xml</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> <li>Forensic analysis of IoT ecosystem <a href="https://hal.archives-ouvertes.fr/hal-03369836/document">https://hal.archives-ouvertes.fr/hal-03369836/document</a></li> </ul> <li>/system/users/0/app_idle_stats.xml</li> <li>/system/users/0/settings_global.xml </li> <li>/system/users/0/settings_secure.xml</li> <ul> <li>Cellebrite CTF 2021 - Heisenberg's Android <a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li> <li>Examining A Malware-Infected Android Phone. This Android Is Not Alright. <a href="https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/">https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py</a></li> </ul> <li>/system/users/0/settings_ssaid.xml</li> <ul> <li>Forensic analysis of instant messengers: Decrypt Signal, Wickr, and Threema <a href="https://www.sciencedirect.com/science/article/pii/S2666281722000166">https://www.sciencedirect.com/science/article/pii/S2666281722000166</a></li> </ul> <li>/system/users/0/settings_system.xml</li> <ul> <li>Android - Roles and Permissions (Android 10/11) <a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li> </ul> <li>/system/appops.xml</li> <ul> <li>Snooping on Android 12’s Privacy Dashboard <a href="https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/">https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/</a></li> <li>Wipeout! Detecting Android Factory Resets <a href="https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/">https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py</a> <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py</a></li> <li>Digital Forensic Practices and Methodologies for AI Speaker Ecosystems <a href="https://www.sciencedirect.com/science/article/pii/S1742287619301628">https://www.sciencedirect.com/science/article/pii/S1742287619301628</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> </ul> <li>/system/batterystats.bin</li> <ul> <li>Video Aficionado: We Know What You Are Watching <a href="https://par.nsf.gov/servlets/purl/10215810">https://par.nsf.gov/servlets/purl/10215810</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> </ul> <li>/system/batterystats-checkin.bin</li> <li>/system/batterystats-daily.xml</li> <ul> <li>Every Step You Take: Application and Network Usage in Android <a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li> </ul> <li>/system/deviceidle.xml</li> <li>/system/locksettings.db</li> <li>/system/netpolicy.xml</li> <ul> <li>Cellebrite CTF 2021 - Heisenberg's Android <a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li> <li>Cellebrite CTF 2021 Writeup <a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> </ul> <li>/system/notification_policy.xml</li> <ul> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li> </ul> <li>/system/PkgPredictions.db</li> <li>/system/SemWifiApContentProvider</li> <ul> <li>Part 2: CTF 2022 Write Up – Heisenberg’s Android <a href="https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/">https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/</a></li> </ul> <li>/system/SimCard.dat</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> <li>/system/WifiConfigStore.db</li> <li>/system/WifiHistory.db</li> <li>/system/wifigeofence.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> </ul> <li>/system/packages.xml</li> <ul> <li>Android - Roles and Permissions (Android 10/11) <a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li> <li>Mobile Forensics: Discovering the Undiscovered <a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li> <li>Some artifacts in the /data/system/ directory <a href="http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html">http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py</a> <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py</a></li> </ul> <li>/system/packages.list</li> <ul> <li>Android - Roles and Permissions (Android 10/11) <a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> <li>Learning Android Forensics - Second Edition <a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a> </li> <li>Learning Android Forensics - Second Edition <a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py</a></li> </ul> <li>/system_ce/0/accounts_ce.db </li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li> <div> <li>Android - Tracking Device Migration <a href="https://blog.d204n6.com/2021/06/android-tracking-device-migration.html">https://blog.d204n6.com/2021/06/android-tracking-device-migration.html</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py</a></li> </div> </ul> <li>/system_ce/recent_images/ </li> <ul> <li>Mobile Forensics: Discovering the Undiscovered <a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li> <li>Android Recent Tasks XML Parser <a href="https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html</a></li> <li>Every Step You Take: Application and Network Usage in Android <a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li> <li>Digital Forensic Practices and Methodologies for AI Speaker Ecosystems <a href="https://www.sciencedirect.com/science/article/pii/S1742287619301628">https://www.sciencedirect.com/science/article/pii/S1742287619301628</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py</a></li> </ul> <li>/system_ce/recent_tasks/</li> <ul> <li>Mobile Forensics: Discovering the Undiscovered <a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li> <li>Android Recent Tasks XML Parser <a href="https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html</a></li> <li>Digital Forensic Practices and Methodologies for AI Speaker Ecosystems <a href="https://www.sciencedirect.com/science/article/pii/S1742287619301628">https://www.sciencedirect.com/science/article/pii/S1742287619301628</a></li> <li>Corroboration. That Is All. <a href="https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/">https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/</a></li> <li>Every Step You Take: Application and Network Usage in Android <a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py</a></li> <li>Write-up Magnet Weekly CTF <a href="https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html">https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html</a></li> </ul> <li>/system_ce/shortcuts/</li> <li>/system_ce/snapshots/</li> <ul> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py</a></li> </ul> <li>/system_ce/usagestats/</li> <ul> <li>Android Usagestats XML Parser <a href="https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html</a></li> <li>Identifying the Android Operating System Version thru UsageStats <a href="https://www.sans.org/white-papers/40265/">https://www.sans.org/white-papers/40265/</a></li> <li>Usagestats on Android 10 (Q) <a href="http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html">http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html</a></li> <li>Mobile Forensics: Discovering the Undiscovered <a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li> <li>Some artifacts in the /data/system/ directory <a href="http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html">http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html</a></li> <li>Android Dumpsys Analysis to Indicate Driver Distraction <a href="https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf">https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf</a></li> <li>Every Step You Take: Application and Network Usage in Android <a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li> <li>Tracking traces of deleted applications <a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a> <a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li> <li>Android version without the build.props file <a href="https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html">https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html</a></li> <li>Android Internals <a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py</a> <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py</a></li> </ul> <li>/system_de/0/accounts_de.db</li> <ul> <li>Android - Tracking Device Migration <a href="https://blog.d204n6.com/2021/06/android-tracking-device-migration.html">https://blog.d204n6.com/2021/06/android-tracking-device-migration.html</a></li> <li>Clockin’ In with Google’s Wear OS <a href="https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/">https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py</a></li> </ul> </ul> </div> </div> <div> <div> <h2 style="text-align: left;">"/user_de" folder</h2> </div> <ul> <li>/user_de/0/com.android.bluetooth/bonddevice.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> </ul> <li>/user_de/0/com.android.providers.telephony/databases/telephony.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Cellebrite CTF 2021 - Heisenberg's Android <a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li> <li>Cellebrite CTF 2021 Writeup <a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a></li> <li>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts <a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li> <li>Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation  <a href="https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf">https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> <li>/user_de/0/com.android.settings/databases/applist.db</li> <li>/user_de/0/com.samsung.accessibility/shared_prefs/accessibility_prefs.xml</li> <li>/user_de/0/com.sec.imsservice/shared_prefs/capdiscovery_0.xml</li> </ul> <div> <h2 style="text-align: left;">"/data" folder</h2> </div> </div> <div> <h3 style="text-align: left;">Digital Wellbeing (com.google.android.apps.wellbeing)</h3> </div> <div> <ul> <li>/data/com.google.android.apps.wellbeing/databases/app_usage </li> <ul> <li>Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity. <a href="https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/">https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/</a></li> </ul> </ul> <div> <h3 style="text-align: left;">Google Docs (com.google.android.apps.docs)</h3> </div> <ul> <li>/data/com.google.android.apps.docs/databases/DocList.db</li> <ul> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py</a></li> <li>Google Docs - Cello & DocList DBs <a href="https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html">https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html</a></li> <li>Digital Forensic Investigation of Cloud Storage Services <a href="https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf">https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf</a></li> <li>Android Cloud Forensics - Final Findings <a href="http://obrienforensics.blogspot.com/2014/04/final-findings.html">http://obrienforensics.blogspot.com/2014/04/final-findings.html</a> </li> <li>Digital Evidence Identification on Google Drive in Android Device Using NIST Mobile Forensic Method <a href="https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf">https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Proposed Method for Mobile Forensics Investigation Analysis of Remnant Data on Google Drive Client <a href="https://jit.ndhu.edu.tw/article/download/1795/1801">https://jit.ndhu.edu.tw/article/download/1795/1801</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> </ul> <div> <h3 style="text-align: left;"> Files by Google (com.google.android.apps.nbu.files) </div> <ul><li>/data/com.google.android.apps.nbu.files/databases/files_master_database</li><ul><li>Files By Google: More Mobile Explorer Artifacts</h3> <a href="https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html">https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html</a></li><li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py</a></li></ul><li>/data/com.google.android.apps.nbu.files/databases/search_history_database</li><ul><li>Files By Google: More Mobile Explorer Artifacts <a href="https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html">https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html</a></li><li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py</a></li></ul></ul> <div> <h3 style="text-align: left;">Device Health Services (com.google.android.apps.turbo)</h3> </div> <ul> <li>/data/com.google.android.apps.turbo/databases/turbo.db</li> <ul> <li>Charging Battery with Turbo DB <a href="https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html">https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html</a></li> <li>Part 2: CTF 2022 Write Up – Heisenberg’s Android <a href="https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/">https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py</a></li> </ul> <li>/data/com.google.android.apps.turbo/databases/bluetooth.db</li> <ul> <li>Turbo Strikes Again - Tracking Bluetooth Device Battery <a href="https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html">https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py</a></li> </ul> <li>/data/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml</li> <ul> <li>Turbo Pt. 3 - Device Health Services Application Usage <a href="https://www.stark4n6.com/2021/06/turbo-application-usage.html">https://www.stark4n6.com/2021/06/turbo-application-usage.html</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py</a></li> </ul> </ul> <div> <h3 style="text-align: left;">Settings Services (com.google.android.settings.intelligence)</h3> </div> <ul> <li>/data/com.google.android.settings.intelligence/databases/battery-usage-db-v4</li> <ul> <li>Application Battery Usage via Settings Services <a href="https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html">https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html</a></li> <li>Examining A Malware-Infected Android Phone. This Android Is Not Alright. <a href="https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/">https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py</a></li> </ul> </ul> <div> <h3 style="text-align: left;">Google Play Service (com.google.android.gms)</h3> </div> <div> <ul style="text-align: left;"> <li>/data/com.google.android.gms/databases/cast.db</li> <ul> <li>An Android Casting (Device) Story: "cast.db" <a href="https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html">https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html</a></li> </ul> <li>/data/com.google.android.gms/databases/constellation.db</li> <ul> <li>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts <a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li> </ul> <li>/data/com.google.android.gms/databases/gass.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py</a></li> </ul> <li>/data/com.google.android.gms/databases/gms.notifications.db</li> <li>/data/com.google.android.gms/databases/google_account_history.db</li> <li>/data/com.google.android.gms/databases/google_app_measurement.db</li> <ul> <li>Forensics on Android Applications <a href="https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&sequence=1">https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&sequence=1</a></li> <li>Forensic Analysis of the Bumble Dating App for Android <a href="https://www.mdpi.com/2673-6756/2/1/16/htm">https://www.mdpi.com/2673-6756/2/1/16/htm</a></li> </ul> <li>/data/com.google.android.gms/databases/herrevad</li> <ul> <li>HERREVAD Databases Geo Location Artefacts <a href="http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html</a></li> <li>Update - HERREVAD Databases Geo Location Artefacts <a href="http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html</a> </li> <li>Update2 - HERREVAD Databases Geo Location Artefacts <a href="http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html</a></li> <li>Update3 - HERREVAD Databases Geo Location Artefacts <a href="http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> </ul> <li>/data/com.google.android.gms/databases/icing_contacts.db</li> <ul> <li>Recovering data from broken screen Android phone - alternative <a href="https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html">https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html</a></li> </ul> <li>/data/com.google.android.gms/databases/icing_mmssms.db</li> <ul> <li>Cellebrite-icing_mmssms.db-Parser <a href="https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md">https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md</a></li> <li>Android Messaging Forensics – SMS/MMS and Beyond <a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li> </ul> <li>/data/data/com.google.android.gms/databases/MdpSimBasedDatabase</li> <ul> <li>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts <a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li> </ul> <li>/data/com.google.android.gms/databases/NetworkUsage.db</li> <ul> <li>Providing Context to the Clues: Recovery and Reliability of Location Data from Android Devices <a href="https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=2353&context=etd">https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=2353&context=etd</a></li> </ul> <li>/data/com.google.android.gms/databases/ns.db</li> <li>/data/com.google.android.gms/databases/reminders.db</li> <ul> <li>Smart Speakers Forensics <a href="https://core.ac.uk/download/pdf/230544843.pdf">https://core.ac.uk/download/pdf/230544843.pdf</a></li> </ul> <li>/data/com.google.android.gms/shared_prefs/batterystats.xml </li> <ul> <li>Every Step You Take: Application and Network Usage in Android <a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li> </ul> <li>/data/com.google.android.gms/shared_prefs/adid_settings.xml</li> <li>/data/com.google.android.gms/shared_prefs/BackupAccount.xml</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> </ul> <li>/data/com.google.android.gms/shared_prefs/Checkin.xml</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts <a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li> <li>Cellebrite CTF 2021 Writeup <a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a></li> <li>Cellebrite CTF 2022 - Heisenberg's Android <a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li> </ul> <li>/data/com.google.android.gms/shared_prefs/nearbysharing:service:state.xml</li> <ul> <li>Nearby Share – AirDrop for Android (Return of the Unsolicited Richard Photograph) <a href="https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/">https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/</a></li> </ul> </ul> <h3 style="text-align: left;">Google Play Store (com.android.vending)</h3> <ul> <li>/data/com.android.vending/databases/data_usage.db</li> <ul> <li>Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications <a href="https://link.springer.com/article/10.1007/s12243-022-00919-6">https://link.springer.com/article/10.1007/s12243-022-00919-6</a></li> </ul> <li>/data/com.android.vending/databases/frosting.db</li> <ul> <li>Analysis of application installation logs on Android systems <a href="https://dl.acm.org/doi/10.1145/3297280.3297489">https://dl.acm.org/doi/10.1145/3297280.3297489</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py</a></li> </ul> <li>/data/com.android.vending/databases/install_queue.db</li> <ul> <li>Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications <a href="https://link.springer.com/article/10.1007/s12243-022-00919-6">https://link.springer.com/article/10.1007/s12243-022-00919-6</a></li> </ul> <li>/data/com.android.vending/databases/library.db</li> <ul> <li>Mobile Forensics: Discovering the Undiscovered <a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li> <li>Analysis of application installation logs on Android systems <a href="https://dl.acm.org/doi/10.1145/3297280.3297489">https://dl.acm.org/doi/10.1145/3297280.3297489</a></li> <li>CTF Cellebrite CTF 2020: Rene Gade <a href="https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/">https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/</a></li> <li>Tracking traces of deleted applications <a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a> <a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li> <li>Every Step You Take: Application and Network Usage in Android <a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py</a></li> </ul> <li>/data/com.android.vending/databases/localappstate.db</li> <ul> <li>Analysis of application installation logs on Android systems <a href="https://dl.acm.org/doi/10.1145/3297280.3297489">https://dl.acm.org/doi/10.1145/3297280.3297489</a></li> <li>Tracking traces of deleted applications <a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a> <a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li> <li>Part 2: CTF 2022 Write Up – Heisenberg’s Android <a href="https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/">https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2015 <a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py</a></li> </ul> <li>/data/com.android.vending/databases/package_verification.db</li> <ul> <li>Tracking traces of deleted applications <a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a> <a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li> </ul> <li>/data/com.android.vending/databases/suggestions.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2015 <a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> <li>/data/com.android.vending/databases/verify_apps.db</li> <ul> <li>Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications <a href="https://link.springer.com/article/10.1007/s12243-022-00919-6">https://link.springer.com/article/10.1007/s12243-022-00919-6</a></li> </ul> </ul> <div> <h3 style="text-align: left;"> Google Quick Search (com.google.android.googlequicksearchbox) </h3> <ul> <li>Google Search & Personal Assistant data on android <a href="http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html">http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html</a></li> <li>Google Search Bar & Search Term History – Are You Finding Everything? <a href="https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/">https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/</a></li> <li>Forensic Investigation of Google Assistant <a href="https://link.springer.com/article/10.1007/s42979-020-00285-x">https://link.springer.com/article/10.1007/s42979-020-00285-x</a></li> <li>How Android Bluetooth Connections Can Determine if a Driver had Their Hands on the Wheel During an Accident <a href="https://dfir.pubpub.org/pub/6ysxvhvc/release/1">https://dfir.pubpub.org/pub/6ysxvhvc/release/1</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>DroidForensics: Accurate Reconstruction of Android Attacks via Multi-layer Forensic Logging <a href="https://kyuhlee.github.io/publications/asiaccs17.pdf">https://kyuhlee.github.io/publications/asiaccs17.pdf</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py</a> <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py</a></li> </ul> </div> <div> <h3 style="text-align: left;"> Google Services Framework (com.google.android.gsf) </h3> </div> <div> <ul> <li>/data/com.google.android.gsf/databases/gservices.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> </ul> <li>/data/com.google.android.gsf/databases/googlesettings.db</li> <ul> <li>Forensic Analysis of Wireless Networking Evidence of Android Smartphones <a href="https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf">https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py</a></li> </ul> </ul> <div> <h3 style="text-align: left;"> Messages (com.google.android.apps.messaging) </h3> </div> <div> <ul> <li>/data/com.google.android.apps.messaging/databases/bugle_db</li> <ul> <li>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts <a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li> <li>Android Messaging Forensics – SMS/MMS and Beyond <a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> <li>/data/com.google.android.apps.messaging/shared_prefs/sim_state_tracker.xml</li> </ul> </div> </div> </div> </div> <div> <div> <h3 style="text-align: left;"> Samsung One UI Home (com.sec.android.app.launcher) </h3> </div> <div> <ul> <li>Recreate Android apps, folders, and widget screen positions from a forensic extraction <a href="https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html">https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html</a></li> </ul> <div> <h3 style="text-align: left;"> Android Contacts Storage (com.android.providers.contacts) </h3> </div> <div> <ul style="text-align: left;"> <li>/data/com.android.providers.contacts/databases/calllog.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> <li>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts <a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li> <li>Calllog.db and SMS data on Android 7.0 Nougat <a href="https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html">https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html</a> </li> <li>Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation  <a href="https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf">https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf</a></li> <li>Call Log query <a href="https://github.com/kacos2000/Queries/blob/master/calllog_db.sql">https://github.com/kacos2000/Queries/blob/master/calllog_db.sql</a></li> <li>Learning Android Forensics - Second Edition <a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li> <li>Practical Mobile Forensics - Fourth Edition <a href="https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520">https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py</a></li> </ul> <li>/data/com.android.providers.contacts/databases/contacts2.db</li> <ul> <li>Open Source Mobile Device Forensics <a href="https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf">https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> <li>Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation  <a href="https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf">https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf</a></li> <li>Contacts query <a href="https://github.com/kacos2000/Queries/blob/master/contacts2.sql">https://github.com/kacos2000/Queries/blob/master/contacts2.sql</a></li> <li>Contacts calls query <a href="https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql">https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql</a></li> <li>Learning Android Forensics - Second Edition <a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li> <li>Practical Mobile Forensics - Fourth Edition <a href="https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520">https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py</a></li> </ul> <li>/data/com.android.providers.contacts/files/photos/</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> </ul> </ul> </div> <div> <h3 style="text-align: left;"> Android Messaging Storage (com.android.providers.telephony) </h3> </div> <ul style="text-align: left;"> <li>/data/user_de/0/com.android.providers.telephony/databases/mmssms.db /data/com.android.providers.telephony/databases/mmssms.db</li> <ul> <li>Android Messaging Forensics – SMS/MMS and Beyond <a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li> <li>Android mmssms.db each table introduction <a href="https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2">https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2</a></li> <li>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device <a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li> <li>Cellebrite CTF 2022 - Heisenberg's Android <a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li> <li>Learning Android Forensics - Second Edition <a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li> <li>Practical Mobile Forensics - Fourth Edition <a href="https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520">https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smsmms.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smsmms.py</a></li> </ul> <li>/data/com.android.providers.telephony/databases/app_parts/</li> <ul> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> </ul> </ul> <div> <h3 style="text-align: left;"> Android Calendar Storage (com.android.providers.calendar) </h3> </div> <ul style="text-align: left;"> <li>/data/com.android.providers.calendar/databases/calendar.db</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2016 <a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2017 <a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2019 <a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2020 <a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2021 <a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> </ul> <li>/data/data/com.google.android.calendar/databases/cal_v2a</li> <ul> <li>Collaborative Testing Services - Mobile Digital Evidence - 2022 <a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li> </ul> </ul> <div> <div> <h3 style="text-align: left;"> Android Media Storage </h3> </div> <div> <ul> <li>/data/com.google.android.providers.media.module/databases/external.db</li> <ul> <li>Android’s external.db – Everything Old Is New Again <a href="https://thebinaryhick.blog/2020/10/19/androids-external-db-everything-old-is-new-again/">https://thebinaryhick.blog/2020/10/19/androids-external-db-everything-old-is-new-again/</a></li> <li>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition <a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/emulatedSmeta.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/emulatedSmeta.py</a></li> </ul> </ul> <div> <h3 style="text-align: left;"> Android Logs Provider (com.sec.android.provider.logsprovider) </h3> </div> <div> <ul> <li>/data/com.sec.android.provider.logsprovider/databases/logs.db</li> <ul> <li>Android Messaging Forensics – SMS/MMS and Beyond <a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li> <li>Logs provider query <a href="https://github.com/kacos2000/Queries/blob/master/logs_db.sql">https://github.com/kacos2000/Queries/blob/master/logs_db.sql</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2015 <a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li> <li>Collaborative Testing Services - Mobile Digital Evidence - 2018 <a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllogs.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllogs.py</a></li> </ul> </ul> </div> <div> <h3 style="text-align: left;"> Android Location (com.google.android.location) </h3> </div> <div> <ul> <li>/data/com.google.android.location/files/cache.cell/cache.wifi /data/com.google.android.location/files/cache.cell/cache.cell</li> <ul> <li>Decoding cache.cell and cache.wifi files <a href="https://forensics.spreitzenbarth.de/2011/10/28/decoding-cache-cell-and-cache-wifi-files/">https://forensics.spreitzenbarth.de/2011/10/28/decoding-cache-cell-and-cache-wifi-files/</a></li> <li>aLEAPP Plugin <a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/cachelocation.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/cachelocation.py</a></li> </ul> </ul> </div> </div> </div> </div> </div>