Area 03
Communications
The telephony and contacts providers keep the handset's native communications in a few SQLite databases. This area covers mmssms.db and its MMS part files, where RCS chats really live (Google Messages and OEM apps keep their own databases), the call log in calllog.db or contacts2.db depending on the version, and the contacts store with its per-account raw contacts and deletion records.
Key artifacts
- mmssms.db
- calllog.db
- contacts2.db
- bugle_db
Artifacts in this area
- SMS and MMS on Android: mmssms.db
The Android telephony provider database holding SMS and MMS: tables, timestamps in ms and seconds, MMS parts, RCS caveats and deleted records.
Android 8-16
- Android Call Log: calllog.db
Where Android stores incoming, outgoing, missed and blocked calls: calllog.db columns, call types, SIM and VoIP accounts, Samsung logs.db and limits.
Android 8-16
- Android Contacts: contacts2.db
The Android contacts provider database: raw contacts per account, the data and mimetypes tables, messaging app accounts and the deleted_contacts log.
Android 8-16
- Google Messages: bugle_db, SMS, MMS and RCS Chats
Google Messages' bugle_db database: RCS chats that never reach mmssms.db, SMS and MMS copies, participants, parts and attachments, timestamps and access.
Android 8-16
- Android Notification History and notification_log.db
Android notification evidence: Android 11+ notification_history protobuf files with title and text, notification_log.db on 8 to 10, and dumpsys notification.
Android 8-16
Guides in this area
No guides yet.
All areas