Sitemap
Every page on Android Forensics.
Home
Investigation areas
Guides
- Android Acquisition: Logical, ADB Backup, Bugreport, FFS
- Android App Usage and Pattern of Life Forensics
- Android Bugreport and dumpsys Forensics
- Android Location Forensics: Timeline, Wi-Fi, EXIF
- Android Stalkerware and Malware Triage with MVT
- Android Messaging Apps Forensics: WhatsApp to RCS
- Android Timeline Analysis: ALEAPP, Epochs and UTC
Artifacts
- Accessibility Services and Device Admin Abuse
- ADB Backup Format: backup.ab Files
- Android Accounts: accounts_ce.db and accounts_de.db
- Android Call Log: calllog.db
- Android Contacts: contacts2.db
- Android Notification History and notification_log.db
- Android Settings: settings_secure, global and system
- Batterystats and Battery History on Android
- Bluetooth on Android: bt_config.conf and Logs
- build.prop and Android Device Identifiers
- Chrome on Android: the History Database
- DCIM, EXIF and MediaStore external.db on Android
- Digital Wellbeing: app_usage Database
- Google Maps Timeline and Location History
- Google Messages: bugle_db, SMS, MMS and RCS Chats
- Installed Apps: packages.xml and packages.list
- Recent Tasks and Snapshots: recent_tasks, snapshots
- Runtime Permissions and App Ops on Android
- Samsung Internet History on Android
- Signal on Android: signal.db, Keys and Backups
- SMS and MMS on Android: mmssms.db
- Telegram on Android: cache4.db and Media
- Usagestats: Android App Usage Events
- WhatsApp on Android: msgstore.db and wa.db
- Wi-Fi Networks on Android: WifiConfigStore.xml
Glossary
- Accessibility Service (Android)
- Android Binary XML (ABX)
- ADB (Android Debug Bridge)
- APK Signing (Android App Signatures)
- BFU and AFU (Before and After First Unlock)
- Bugreport (Android dumpstate)
- Credential Encrypted (CE) and Device Encrypted (DE) Storage
- File-Based Encryption (FBE)
- Full File System Extraction (FFS)
- Protocol Buffers (protobuf)
- RCS (Rich Communication Services)
- SQLite WAL (Write-Ahead Log)
- Usagestats