man 7 dfir

Glossary

Plain-language definitions of the Android forensics terms used across the guides and artifact pages.

Accessibility Service (Android): An Android accessibility service reads on-screen content and performs actions for the user; stalkerware and banking trojans abuse it to spy and self-grant.
ADB (Android Debug Bridge): ADB is Google's command-line bridge to an Android device over USB or Wi-Fi: shell, file transfer, bugreports and backups for logical acquisition.
Android Binary XML (ABX): ABX is the compact binary XML format Android 12 and later use for system files such as packages.xml and settings; convert it with abx2xml or ccl_abx.
APK Signing (Android App Signatures): Every Android APK is signed with a developer certificate; the signature decides who can update an app and helps separate genuine apps from lookalike malware.
BFU and AFU (Before and After First Unlock): BFU and AFU are the two lock states that decide what an Android extraction can decrypt: device-encrypted data only before first unlock, most data after it.
Bugreport (Android dumpstate): An Android bugreport is a zip produced by dumpstate with dumpsys output for every system service, logcat, kernel logs and system files, collected without root.
Credential Encrypted (CE) and Device Encrypted (DE) Storage: Android splits user data into credential-encrypted storage, unlocked by the passcode, and device-encrypted storage, available at boot; CE holds most app data.
File-Based Encryption (FBE): File-based encryption is how Android encrypts user data per file with keys tied to the lock screen, splitting storage into CE and DE classes.
Full File System Extraction (FFS): A full file system extraction copies the Android file system as the running OS sees it, including /data app sandboxes, decrypted by the device's own keys.
Protocol Buffers (protobuf): Protocol Buffers is Google's compact binary serialization format; Android uses it for usagestats, system dumps and many Google app data files.
RCS (Rich Communication Services): RCS is the carrier messaging standard that replaces SMS with chat features; on Android its messages live in the messaging app's database, not mmssms.db.
SQLite WAL (Write-Ahead Log): The SQLite write-ahead log (-wal file) holds recent changes not yet merged into the database; on Android it often contains the newest messages.
Usagestats: Usagestats is Android's system record of app foreground and background events, screen and keyguard state, kept in daily, weekly, monthly and yearly files.