Area 02
System & Device
Before reading any app, pin down the device: its model, Android version and security patch from build.prop, the user profiles, the Google and third-party accounts in the account databases, the settings stores, and every installed package with its installer and install times. On Android 12 and later many of these XML files are stored in Android Binary XML (ABX) and must be converted before they can be read.
Key artifacts
- build.prop
- packages.xml
- accounts_ce.db
- settings_secure.xml
Artifacts in this area
- Installed Apps: packages.xml and packages.list
Android's package manager state: packages.xml install and update times, installer and initiator, UIDs, signatures and permissions, packages.list and ABX.
Android 8-16
- build.prop and Android Device Identifiers
Identify an Android device: build.prop and getprop keys, persistent properties, time zone, serial, IMEI, Android ID and factory reset time in bootstat.
Android 8-16
- Android Accounts: accounts_ce.db and accounts_de.db
Android's AccountManager databases: which Google, Samsung and app accounts are on the phone, CE and DE split, password entry times, debug history and tokens.
Android 8-16
- Android Settings: settings_secure, global and system
Android settings stores: settings_secure.xml, settings_global.xml and settings_system.xml, the forensic keys, ABX format and the settings command.
Android 8-16
- Runtime Permissions and App Ops on Android
runtime-permissions.xml and appops.xml: which dangerous permissions each app holds, grant flags, last access and reject times, and Privacy dashboard history.
Android 8-16
- Bluetooth on Android: bt_config.conf and Logs
Android Bluetooth evidence: paired devices in bt_config.conf with names, classes and pairing times, dumpsys bluetooth_manager and HCI snoop logs.
Android 8-16
- Batterystats and Battery History on Android
Android batterystats: battery history of screen, charging, top app, wakelocks and radios, from dumpsys, bugreports and batterystats.bin, with time decoding.
Android 8-16
Guides in this area
No guides yet.
All areas