Android DFIR field reference
Where each artifact lives on Android 8 to 16, which extraction level reaches it, what it proves and how to parse it: messages and calls, messaging apps, location, app usage, browsers, system files and malware.
/data/evidence
Nine areas cover the evidence that matters on a handset, from getting the data out to building the timeline. Each links to artifact pages and in-depth guides.
Choose between logical, ADB backup, bugreport, full file system and physical extraction, and know what each one reaches.
Identify the build, installed apps, accounts, settings and lock configuration from /data/system and friends.
Recover SMS, MMS and RCS, the call log and the contacts database, including OEM variants and deleted rows.
Parse WhatsApp, Telegram, Signal and other chat apps from their sandboxes, encrypted backups and exports.
Place the device using Google location history, saved Wi-Fi networks, cell data and photo metadata.
Show which app was in the foreground and when, from usagestats, Digital Wellbeing, battery stats and recent tasks.
Read Chrome and Samsung Internet history, downloads and searches, and the photos, videos and thumbnails in shared storage.
Triage spyware and stalkerware: sideloaded packages, dangerous permissions, accessibility and device admin abuse, and MVT checks.
Normalise Android epochs to UTC and merge messages, calls, usage, location and installs into one device timeline.
workflow
The same five phases apply whether you have a bugreport, an ADB backup or a full file system extraction.
Keep the phone powered and isolated from networks. Record its lock state (BFU or AFU), build and battery level.
Pick the deepest level you can justify: logical and bugreport first, then full file system through an agent, root or exploit.
Open the SQLite databases with their WAL files, the protobuf and XML system files, and each app's own storage.
Normalise every epoch to UTC and merge messages, calls, app usage, location and installs into one timeline.
State the extraction level, Android version and what each artifact can and cannot prove on that build.
~/guides
How to acquire an Android phone: what logical, ADB backup, bugreport, full file system and physical extraction each reach, and how FBE and lock state decide.
Prove when an Android phone was used and which app was on screen: usagestats, Digital Wellbeing, batterystats, recent tasks and notifications, combined.
Collect and read an Android bugreport: dumpstate layout, the dumpsys sections that matter for forensics, logcat, time handling, privacy and tools like MVT.
Place an Android phone in space and time: Google Maps Timeline after the on-device move, Wi-Fi and Bluetooth, cell data, photo EXIF, and how to weigh them.
Triage an Android phone for stalkerware and spyware: sideloaded APKs, accessibility, notification access, device admin, permissions, and MVT with androidqf.
How to acquire and analyse WhatsApp, Signal, Telegram and Google Messages on Android: where each stores chats, what encryption blocks, and what survives.
adb shell man
Short, precise definitions of the terms you will meet in Android investigations.
Open the glossary