Android artifacts cheat sheet
Every artifact on one table, grouped by category. Use your browser's print dialog (landscape) or save it as a PDF.
www.androidforensics.app/en/artifacts
| Artifact | Location | Proves | Timestamps | Access | Retention | Parsers |
|---|---|---|---|---|---|---|
| Communications | ||||||
| Call log (calllog.db)Android 8-16 | /data/user_de/0/com.android.providers.contacts/databases/calllog.db | Which calls the device placed, received, missed, rejected or blocked, with which number, when, for how long, and through which SIM or calling app | calls.date (call start) and last_modified in Unix milliseconds (UTC); duration in seconds | Full file system (root, exploit or agent); DE storage, so readable in BFU by a privileged extraction. Logical: provider view through an agent app or, on some builds, adb shell content query. Bugreport: short masked history only. Not in ADB backup. | AOSP trims the log to about the 500 most recent entries; the exact rule varies by release and OEM. Deleted rows can persist in the WAL and freelist | ALEAPP, Andriller, Autopsy, sqlite3, DB Browser for SQLite, content, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, MSAB XRY |
| Contacts (contacts2.db)Android 8-16 | /data/data/com.android.providers.contacts/databases/contacts2.db | Which contacts exist on the device, from which account (Google, SIM, WhatsApp, Telegram, Signal...), their numbers and emails, and when contacts were changed or deleted | contacts.contact_last_updated_timestamp and deleted_contacts.contact_deleted_timestamp in Unix milliseconds (UTC); usage columns frozen since Android 10 | Full file system (root, exploit or agent); credential-encrypted storage, so AFU only. Logical: provider view through an agent app. Not in ADB backup or bugreport (dumpsys account lists the accounts only). | Until deleted or unsynced; deleted_contacts keeps IDs and deletion times for about 30 days; synced accounts also persist server-side | ALEAPP, Andriller, Autopsy, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, MSAB XRY |
| Google Messages (bugle_db)Android 8-16 | /data/data/com.google.android.apps.messaging/databases/bugle_db | SMS, MMS and RCS conversations handled by Google Messages, their participants, message text and attachments, direction, send and receive times, read and delivery state | Unix milliseconds (UTC): messages.sent_timestamp, messages.received_timestamp, parts.timestamp, conversations.sort_timestamp | Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Logical: not reachable, and agents that read the SMS provider miss RCS entirely. Not in ADB backup on current app versions. | Until the user deletes the message or conversation, or the app data is cleared; RCS content is not mirrored to the SMS provider, so deleting it here removes the main local copy | ALEAPP, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, MSAB XRY |
| Signal (signal.db)Android 8-16 | /data/data/org.thoughtcrime.securesms/databases/signal.db | Signal conversations, message text, senders, direction, sent, received and read times, calls, attachments and group membership, once the database is decrypted | Unix milliseconds (UTC): message.date_sent, date_received, date_server; call.timestamp; thread.date | Full file system (root, exploit or agent), AFU only, plus the Android Keystore key on the same device to unwrap the database secret. Logical: only user-created .backup files. Not in ADB backup. | Until the user deletes messages or chats, disappearing-message timers expire, or the app is removed; local .backup files rotate (usually the two newest are kept) | signalbackup-tools, SQLCipher, sqlite3, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| SMS / MMS (mmssms.db)Android 8-16 | /data/user_de/0/com.android.providers.telephony/databases/mmssms.db | Which SMS and MMS were received, sent, drafted or failed, with whom, when, on which SIM, and which app wrote each SMS | sms.date and sms.date_sent in Unix milliseconds (UTC); pdu.date and pdu.date_sent in Unix seconds | Full file system (root, exploit or agent); DE storage, so readable in BFU by a privileged extraction. Logical: provider view only through an agent app with SMS permission. Not in ADB backup or bugreport. | Until the user or the messaging app deletes the thread, or factory reset; deleted rows may survive in freelist pages and the WAL or journal | ALEAPP, Andriller, Autopsy, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, MSAB XRY |
| Telegram (cache4.db)Android 8-16 | /data/data/org.telegram.messenger/files/cache4.db | Telegram chats, groups and channels cached on the device, message text and media references, senders, direction, send times, secret chats, and the account's contacts | Unix seconds (UTC): messages_v2.date, dialogs.date; some tables add milliseconds or server-side dates inside the serialized data blob | Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Logical: only media in shared storage. Not in ADB backup on current versions. | A local cache of cloud chats: history the app has loaded, trimmed by the user's cache settings; secret chats exist only on devices and follow their self-destruct timers | sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, Belkasoft X, MSAB XRY |
| WhatsApp (msgstore.db / wa.db)Android 8-16 | /data/data/com.whatsapp/databases/msgstore.db | WhatsApp chats and groups, message text, direction, sender, sent and received times, media, calls, and contact names of chat partners | Unix milliseconds (UTC): message.timestamp, received_timestamp, receipt tables, chat.created_timestamp, call_log.timestamp | Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Logical: only encrypted local backups and media in shared storage, plus user chat exports. ADB backup only via an APK downgrade method. | Until the user deletes messages or chats, disappearing-message timers expire, or the app is removed; local backups rotate (usually about 7 daily copies) | ALEAPP, wa-crypt-tools, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, MSAB XRY, Belkasoft X |
| Location | ||||||
| Google Maps TimelineAndroid 8-16 | On device (2024+): inside the Google Maps and Google Play services sandboxes under /data/data/; exports: Timeline.json; legacy cloud: Takeout Location History (Records.json, Semantic Location History) | Where the device (and the signed-in Google account) was over time: raw position fixes with accuracy, inferred place visits with start and end times, and travel segments with activity type | Takeout Records.json: ISO 8601 UTC strings (older exports: timestampMs in Unix milliseconds); Timeline.json: ISO 8601 with UTC offset; semantic history: start and end timestamps per visit or segment | On-device Timeline: full file system (root, exploit or agent), credential-encrypted sandboxes, AFU only. User export from the phone's Timeline settings. Legacy cloud history: Google Takeout or legal process to Google, only for data not yet migrated or deleted. | User-controlled auto-delete (3, 18 or 36 months, or never); on-device data is lost with the phone unless the encrypted Timeline backup was enabled; legacy cloud history was deleted by Google after the migration deadlines | ALEAPP, RLEAPP, jq, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Wi-Fi config (WifiConfigStore.xml)Android 8-16 | /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml (Android 11+), /data/misc/wifi/WifiConfigStore.xml (Android 8 to 10) | Which Wi-Fi networks the device saved, whether it ever connected to them, who added them (user in Settings or an app), their security type and key, and the MAC address the phone used on each | Few per-network times: some builds store creation or update strings without a year, newer builds may add connection times; rely on file system times and other artifacts | Full file system (root, exploit or agent); system device-encrypted storage, so readable in BFU by a privileged extraction. Logical and bugreport: saved networks via dumpsys wifi (keys masked). Not in ADB backup. | Until the user forgets the network, the configuring app removes its suggestion, or factory reset | ALEAPP, xmllint, Python ElementTree, abx2xml, ccl_abx, dumpsys, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Network | ||||||
| Bluetooth (bt_config.conf)Android 8-16 | /data/misc/bluedroid/bt_config.conf (+ bt_config.bak); some recent builds use /data/misc/bluetooth/ | Which Bluetooth devices were paired (car head units, headsets, watches, trackers, computers), their names, addresses and device classes, when each was paired, and the phone's own Bluetooth name and address | Per-device Timestamp in Unix seconds (pairing or bonding time on AOSP); dumpsys bluetooth_manager prints enable and disable events in local time; HCI snoop logs carry per-packet times | Full file system (root, exploit or agent): /data/misc is device-encrypted, so BFU readable by a privileged extraction. Logical and bugreport: dumpsys bluetooth_manager lists bonded devices and recent activity. Not in ADB backup. | A paired device stays until it is unpaired or Bluetooth data is reset; the enable and disable log is short and in memory; HCI snoop logs exist only when the developer option was on | ALEAPP, dumpsys, Wireshark, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| App usage | ||||||
| BatterystatsAndroid 8-16 | /data/system/batterystats.bin, /data/system/batterystats-checkin.bin, /data/system/battery-history/ (layout varies by release) | When the screen was on, when the device was plugged in or unplugged, which app was on top, which apps held wakelocks, ran jobs or used GPS, Wi-Fi and mobile radio since the last reset | History entries are offsets from a reference point printed in the dump (RESET:TIME, TIME: lines with wall-clock time); checkin output uses Unix milliseconds | Logical (no root): adb shell dumpsys batterystats. Bugreport: included. Full file system: the .bin files in /data/system, device-encrypted, so readable in BFU by a privileged extraction. Not in ADB backup. | Detailed history since the last full charge or statistics reset, capped by a size limit; aggregate statistics roll over with each reset | dumpsys, Battery Historian, ALEAPP, Magnet AXIOM, Cellebrite UFED |
| Digital Wellbeing (app_usage)Android 9-16 | /data/data/com.google.android.apps.wellbeing/databases/app_usage | When apps came to the foreground and went to the background, device shutdown and startup, and, on some versions, notification and unlock counts per app | Unix milliseconds (UTC): events.timestamp | Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Logical: the dashboard on screen, or dumpsys usagestats for the underlying system events. Not in ADB backup. | A rolling window of roughly one to two weeks of events on the versions examined publicly; verify on your build | ALEAPP, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| UsagestatsAndroid 8-16 | /data/system_ce/0/usagestats/ (Android 11+), /data/system/usagestats/0/ (Android 8 to 10) | When each app's activities came to the foreground and left it, when the screen turned on and off, when the keyguard was shown and dismissed, device startup and shutdown | File names are the interval start in Unix milliseconds (UTC); event times are stored as millisecond offsets from that start and must be added to it | Full file system (root, exploit or agent); credential-encrypted from Android 11, so AFU only on 11+. Logical and bugreport: recent in-memory events via dumpsys usagestats. Not in ADB backup. | AOSP defaults: daily files about 10 days, weekly about 4 weeks, monthly about 6 months, yearly a few years; detailed events are in the daily files | ALEAPP, blackboxprotobuf, protoc, dumpsys, Magnet AXIOM, Cellebrite UFED, Oxygen Forensic Detective |
| User activity | ||||||
| Notification historyAndroid 8-16 | /data/system_ce/<user>/notification_history/ (Android 11+), /data/system/notification_log.db (Android 8 to 10) | Which app posted a notification and when, and on Android 11+ with history enabled, the notification's title and text: message previews, sender names, one-time codes | notification_history: posted time in Unix milliseconds (UTC), files named by Unix milliseconds; notification_log.db: Unix milliseconds | Full file system (root, exploit or agent). Android 11+ history is credential-encrypted, so AFU only; notification_log.db sits in device-encrypted /data/system. Logical and bugreport: dumpsys notification lists current and recently removed notifications. Not in ADB backup. | Android 11+ history: only when the user enabled Notification history, about the last 24 hours; notification_log.db: a bounded rolling window; dumpsys: in memory until reboot | ALEAPP, blackboxprotobuf, protoc, dumpsys, sqlite3, Magnet AXIOM, Cellebrite UFED |
| Chrome HistoryAndroid 8-16 | /data/data/com.android.chrome/app_chrome/Default/History | Which pages Chrome loaded, when, how the user got there (typed, link, form, reload), what was searched and what was downloaded where | WebKit/Chrome time: microseconds since 1601-01-01 UTC (urls.last_visit_time, visits.visit_time, downloads.start_time and end_time) | Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Not in logical extraction, ADB backup or bugreport. Downloaded files themselves are in shared storage (logical). | Chrome expires history older than about 90 days; the user can clear it; Incognito tabs write nothing here | ALEAPP, Hindsight, Plaso, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, MSAB XRY |
| Recent tasks and snapshotsAndroid 8-16 | /data/system_ce/<user>/recent_tasks/ and /data/system_ce/<user>/snapshots/ | Which app tasks were in the Overview (recents) screen, which activity each started from, when each was last moved to the front, and an image of what each app showed when it was last left | Task XML: last_time_moved (and related attributes) in Unix milliseconds (UTC); snapshot images: file system modification times | Full file system (root, exploit or agent); credential-encrypted storage, so AFU only. Logical and bugreport: dumpsys activity recents lists current tasks, without images. Not in ADB backup. | Until the task is removed from Overview (swiped away, cleared, app uninstalled) or the recents list overflows; persists across reboots | ALEAPP, abx2xml, ccl_abx, xmllint, dumpsys, Magnet AXIOM, Cellebrite UFED |
| Samsung Internet (History)Android 8-16 | /data/data/com.sec.android.app.sbrowser/app_sbrowser/Default/History | Web pages visited in Samsung Internet's normal mode, with per-visit times and navigation type, typed URLs, search terms and downloads | WebKit/Chrome time: microseconds since 1601-01-01 UTC (urls.last_visit_time, visits.visit_time, downloads.start_time and end_time) | Full file system (root, exploit or agent); credential-encrypted sandbox, so AFU only. Logical: downloaded files in shared storage only. Not in ADB backup on current versions. | Chromium expires history after about 90 days; the user can clear it at any time; Secret mode browsing is not written to this database | ALEAPP, Hindsight, sqlite3, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Media | ||||||
| DCIM, EXIF and MediaStoreAndroid 8-16 | /sdcard/DCIM/Camera/ (media), external.db in the MediaProvider sandbox (com.android.providers.media, or com.google.android.providers.media.module on 11+) | Which photos and videos exist, when and where they were taken (EXIF), which app created each file, when files were added, modified or moved to trash, and which images existed before deletion | EXIF DateTimeOriginal in local time without zone unless OffsetTimeOriginal is present; GPSDateStamp and GPSTimeStamp in UTC; MediaStore date_added and date_modified in Unix seconds, datetaken in Unix milliseconds | Logical: shared storage (DCIM, Pictures, Download) is readable over ADB without root. MediaStore database: full file system (root, exploit or agent), AFU only. Not in ADB backup unless -shared (files only). | Until the user deletes the file; Android 11+ trash keeps deleted items about 30 days; gallery apps keep their own trash and caches; MediaStore rows are removed with the file | ExifTool, ALEAPP, sqlite3, adb, Autopsy, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Device & system | ||||||
| ADB backup (.ab)Android 8-16 | Examiner workstation: the file written by adb backup -f <name>.ab (not stored on the device) | The private data (databases, shared preferences, files) of apps that allow backup, optionally their APKs and shared storage, as the device held them when the backup ran | No global timestamp in the header; tar entries carry file modification times in Unix seconds; the app data inside keeps its own formats | Logical: needs an unlocked phone, USB debugging and on-screen confirmation. Since Android 12, excludes apps targeting API 31+ unless debuggable; apps with allowBackup=false are always excluded. | A point-in-time copy created by the examiner; nothing is kept on the device | adb, Android Backup Extractor, hashcat, John the Ripper, ALEAPP, Cellebrite UFED, Magnet AXIOM |
| Accounts (accounts_ce.db / accounts_de.db)Android 8-16 | /data/system_ce/<user>/accounts_ce.db and /data/system_de/<user>/accounts_de.db | Which accounts (Google, Samsung, Microsoft, messaging and social apps) were registered on the device per user, their account types, when a password was last entered, and recent account operations | accounts.last_password_entry_time_millis_epoch in Unix milliseconds (UTC); debug_table.time as a text date in device local time on AOSP | Full file system (root, exploit or agent): accounts_de.db is device-encrypted (BFU readable by a privileged extraction), accounts_ce.db is credential-encrypted (AFU only). Logical and bugreport: dumpsys account lists accounts and recent history. Not in ADB backup. | Current state: an account removed from the device is deleted from both databases; the debug history keeps a small ring of recent operations | ALEAPP, sqlite3, dumpsys, DB Browser for SQLite, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Settings (settings_*.xml)Android 8-16 | /data/system/users/<user>/settings_secure.xml, settings_global.xml (user 0 only), settings_system.xml | Device configuration at extraction time: enabled accessibility services and notification listeners, input methods, ADB and developer options, automatic time, airplane mode, Bluetooth and Wi-Fi state, device name, screen timeout | No per-setting timestamps; only the file's modification time, which reflects the latest change of any setting in the file | Logical (no root): adb shell settings list secure|global|system. Bugreport: settings dumps. Full file system: /data/system/users is device-encrypted, so BFU readable by a privileged extraction. Not in ADB backup. | Current values only; a changed setting overwrites the previous value, and a factory reset restores defaults | abx2xml, ccl_abx, xmllint, Python ElementTree, settings, dumpsys, ALEAPP, MVT |
| build.prop and device identifiersAndroid 8-16 | /system/build.prop, /vendor/build.prop, /product/etc/build.prop, /data/property/persistent_properties, /data/misc/bootstat/ | The device's manufacturer, model, Android version, security patch level and build fingerprint, its configured time zone and locale, identifiers such as the serial number and per-app Android IDs, and, where present, when it was last factory reset | ro.build.date.utc in Unix seconds; bootstat files record boot and factory reset times (values or file modification times, depending on the file) | Logical (no root): getprop and the build.prop files are readable by the shell user. Bugreport: full property list. Full file system: persistent_properties and bootstat are in device-encrypted /data, so BFU readable by a privileged extraction. | build.prop changes only with a system update; persistent properties until changed or reset; bootstat files survive until the next factory reset | adb, getprop, ALEAPP, blackboxprotobuf, protoc, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Installed packages (packages.xml)Android 8-16 | /data/system/packages.xml | Which apps are installed, when each was first installed and last updated, which app installed it (store, package installer, browser, adb), its UID, signing certificate and install-time permissions | Attributes ft, it and ut are hexadecimal Unix milliseconds (UTC): APK timestamp, first install, last update | Full file system (root, exploit or agent); system device-encrypted storage, readable in BFU by a privileged extraction. Logical and bugreport: the same facts via pm and dumpsys package. Not in ADB backup. | Current state only: an uninstalled app disappears from packages.xml; traces remain in usagestats, Play Store databases and other logs | ALEAPP, MVT, abx2xml, ccl_abx, xmllint, pm, dumpsys, jadx, Apktool, Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective |
| Security & malware | ||||||
| Accessibility and device adminAndroid 8-16 | /data/system/users/<user>/settings_secure.xml (enabled_accessibility_services, enabled_notification_listeners), /data/system/device_policies.xml, /data/system/device_owner_2.xml | Which apps could read and control the screen through accessibility, read all notifications, or act as device administrator or device owner, and with which policies | No grant timestamps in these files; date the grant from file modification times, usagestats (Settings in the foreground), install times and appops | Logical (no root): settings get secure, dumpsys accessibility, dumpsys device_policy, dumpsys notification. Bugreport: included. Full file system: device-encrypted /data/system, so BFU readable by a privileged extraction. Not in ADB backup. | Current state: disabling a service or removing an admin rewrites the setting or file; uninstalling the app removes its entries | MVT, androidqf, dumpsys, settings, apksigner, jadx, Apktool, abx2xml, ccl_abx, ALEAPP |
| Runtime permissions and appopsAndroid 8-16 | /data/misc_de/<user>/apexdata/com.android.permission/runtime-permissions.xml (11+), /data/system/users/<user>/runtime-permissions.xml (8 to 10), /data/system/appops.xml | Which runtime permissions (location, camera, microphone, SMS, contacts, call log) each app was granted or denied and how, and when an app last used or was refused a protected operation | runtime-permissions.xml: none per grant; appops: last access and last reject times in Unix milliseconds (UTC) per operation; discrete history on Android 11+ for the Privacy dashboard | Full file system (root, exploit or agent): both files are in device-encrypted storage, so BFU readable by a privileged extraction. Logical (no root): dumpsys package and dumpsys appops, cmd appops get. Bugreport: included. Not in ADB backup. | Current grants only; appops last-access times are overwritten by the next access; discrete access history covers a short recent window (about 24 hours to 7 days depending on the release) | dumpsys, appops, pm, abx2xml, ccl_abx, xmllint, MVT, androidqf, ALEAPP |