Android forensic artifacts

Android Call Log: calllog.db

Where Android stores incoming, outgoing, missed and blocked calls: calllog.db columns, call types, SIM and VoIP accounts, Samsung logs.db and limits.

/data/user_de/0/com.android.providers.contacts/databases/calllog.db

Android 8-16

Android Contacts: contacts2.db

The Android contacts provider database: raw contacts per account, the data and mimetypes tables, messaging app accounts and the deleted_contacts log.

/data/data/com.android.providers.contacts/databases/contacts2.db

Android 8-16

Google Messages: bugle_db, SMS, MMS and RCS Chats

Google Messages' bugle_db database: RCS chats that never reach mmssms.db, SMS and MMS copies, participants, parts and attachments, timestamps and access.

/data/data/com.google.android.apps.messaging/databases/bugle_db

Android 8-16

Signal on Android: signal.db, Keys and Backups

Signal on Android: the SQLCipher signal.db, how its key is wrapped by the Android Keystore, encrypted attachments, .backup files and what survives outside.

/data/data/org.thoughtcrime.securesms/databases/signal.db

Android 8-16

SMS and MMS on Android: mmssms.db

The Android telephony provider database holding SMS and MMS: tables, timestamps in ms and seconds, MMS parts, RCS caveats and deleted records.

/data/user_de/0/com.android.providers.telephony/databases/mmssms.db

Android 8-16

Telegram on Android: cache4.db and Media

Telegram's Android cache4.db: messages_v2, dialogs, users and secret chats, TL-serialized blobs, per-account folders, media paths and what the cloud keeps.

/data/data/org.telegram.messenger/files/cache4.db

Android 8-16

WhatsApp on Android: msgstore.db and wa.db

WhatsApp's Android databases and backups: msgstore.db message and chat tables, wa.db contacts, crypt14 and crypt15 backups, media paths and deleted messages.

/data/data/com.whatsapp/databases/msgstore.db

Android 8-16

Google Maps Timeline and Location History

Google Location History and Maps Timeline: the legacy cloud Records.json, the 2024 to 2025 move to on-device storage, Timeline.json exports and what remains.

On device (2024+): inside the Google Maps and Google Play services sandboxes under /data/data/; exports: Timeline.json; legacy cloud: Takeout Location History (Records.json, Semantic Location History)

Android 8-16

Wi-Fi Networks on Android: WifiConfigStore.xml

Saved Wi-Fi networks on Android: WifiConfigStore.xml paths per version, SSIDs, keys, creator app, per-network randomized MAC, connection status and caveats.

/data/misc/apexdata/com.android.wifi/WifiConfigStore.xml (Android 11+), /data/misc/wifi/WifiConfigStore.xml (Android 8 to 10)

Android 8-16

Bluetooth on Android: bt_config.conf and Logs

Android Bluetooth evidence: paired devices in bt_config.conf with names, classes and pairing times, dumpsys bluetooth_manager and HCI snoop logs.

/data/misc/bluedroid/bt_config.conf (+ bt_config.bak); some recent builds use /data/misc/bluetooth/

Android 8-16

Batterystats and Battery History on Android

Android batterystats: battery history of screen, charging, top app, wakelocks and radios, from dumpsys, bugreports and batterystats.bin, with time decoding.

/data/system/batterystats.bin, /data/system/batterystats-checkin.bin, /data/system/battery-history/ (layout varies by release)

Android 8-16

Digital Wellbeing: app_usage Database

Google Digital Wellbeing's app_usage database on Android 9+: app open and close events, unlocks and notifications, Samsung's variant, retention and parsing.

/data/data/com.google.android.apps.wellbeing/databases/app_usage

Android 9-16

Usagestats: Android App Usage Events

Android usagestats files: app foreground and background events, screen and keyguard state, XML and protobuf formats, paths per version and retention.

/data/system_ce/0/usagestats/ (Android 11+), /data/system/usagestats/0/ (Android 8 to 10)

Android 8-16

Android Notification History and notification_log.db

Android notification evidence: Android 11+ notification_history protobuf files with title and text, notification_log.db on 8 to 10, and dumpsys notification.

/data/system_ce/<user>/notification_history/ (Android 11+), /data/system/notification_log.db (Android 8 to 10)

Android 8-16

Chrome on Android: the History Database

Chrome's History SQLite database on Android: visited URLs, per-visit transitions, downloads and search terms, WebKit timestamps, synced visits and retention.

/data/data/com.android.chrome/app_chrome/Default/History

Android 8-16

Recent Tasks and Snapshots: recent_tasks, snapshots

Android recent tasks XML and task snapshot images in system_ce: what the Overview screen stored, last active times, screenshots of app screens, FLAG_SECURE.

/data/system_ce/<user>/recent_tasks/ and /data/system_ce/<user>/snapshots/

Android 8-16

Samsung Internet History on Android

Samsung Internet on Android: the Chromium History database, downloads and search terms, Samsung's own tab and bookmark stores, and Secret mode limits.

/data/data/com.sec.android.app.sbrowser/app_sbrowser/Default/History

Android 8-16

DCIM, EXIF and MediaStore external.db on Android

Android photos and videos as evidence: DCIM naming, EXIF time and GPS, the MediaStore external.db index, owner package, trash and thumbnail caches.

/sdcard/DCIM/Camera/ (media), external.db in the MediaProvider sandbox (com.android.providers.media, or com.google.android.providers.media.module on 11+)

Android 8-16

ADB Backup Format: backup.ab Files

The Android ADB backup .ab format: header, zlib tar stream, AES-256 encryption with PBKDF2, app folder layout, Android 12 limits and hashcat mode 18900.

Examiner workstation: the file written by adb backup -f <name>.ab (not stored on the device)

Android 8-16

Android Accounts: accounts_ce.db and accounts_de.db

Android's AccountManager databases: which Google, Samsung and app accounts are on the phone, CE and DE split, password entry times, debug history and tokens.

/data/system_ce/<user>/accounts_ce.db and /data/system_de/<user>/accounts_de.db

Android 8-16

Android Settings: settings_secure, global and system

Android settings stores: settings_secure.xml, settings_global.xml and settings_system.xml, the forensic keys, ABX format and the settings command.

/data/system/users/<user>/settings_secure.xml, settings_global.xml (user 0 only), settings_system.xml

Android 8-16

build.prop and Android Device Identifiers

Identify an Android device: build.prop and getprop keys, persistent properties, time zone, serial, IMEI, Android ID and factory reset time in bootstat.

/system/build.prop, /vendor/build.prop, /product/etc/build.prop, /data/property/persistent_properties, /data/misc/bootstat/

Android 8-16

Installed Apps: packages.xml and packages.list

Android's package manager state: packages.xml install and update times, installer and initiator, UIDs, signatures and permissions, packages.list and ABX.

/data/system/packages.xml

Android 8-16

Accessibility Services and Device Admin Abuse

How Android stalkerware and banking trojans abuse accessibility, notification listeners and device admin: settings keys, device_policies.xml and checks.

/data/system/users/<user>/settings_secure.xml (enabled_accessibility_services, enabled_notification_listeners), /data/system/device_policies.xml, /data/system/device_owner_2.xml

Android 8-16

Runtime Permissions and App Ops on Android

runtime-permissions.xml and appops.xml: which dangerous permissions each app holds, grant flags, last access and reject times, and Privacy dashboard history.

/data/misc_de/<user>/apexdata/com.android.permission/runtime-permissions.xml (11+), /data/system/users/<user>/runtime-permissions.xml (8 to 10), /data/system/appops.xml

Android 8-16