Skip to content

Android Forensics Artifacts

Android Analysis

Android Forensics Artifacts

SMS/Call logs

Location

  • SMS : /data/data/com.android.providers.telephony/databases/mmssms.db
  • Call logs : /data/data/com.android.providers.contacts/databases/calllog.db

Forensic Value

  • Recovers complete text message content
  • Provides sender/reciver numbers and timestamps
  • Provides conversation reconstruction and timeline validation
  • Useful for mapping user communication patterns
Contacts and Address Book

db contains all details of contacts saved via accounts
Location

  • /data/data/com.android.providers.contacts/databases/contacts2.db

Forensic Value

  • Identifies social connection and associates
  • Provides potential leads through phone numbers and emails
  • Supports triangulation will call logs and messages
Browser history

These databases record detailed web activity including visited urls, search terms etc. Depending on browser setting you might also get data entered via form
Location : /data/data/com.android.chrome/app_chrome/Default/History
Forensic Value :

  • reveals internet usage habits and search interests
  • can indicate planning or intent(eg: searches about crimes or escape routes)
  • may expose accessed web services like cloud storage or forums
Location Data

Devices often record detailed GPS and network-based location through Google play services. These track location, movements, place labels, timestamps , usually even when apps are not actively used
Location :

Forensics value

  • Maps location movements
  • help confirm or refute presence at a crime scene
  • cruicial in recontructing past activities and routes
Photos, Videos and Metadata

Photos often store metadata like timestamps, geolocation , device model in EXIF headers
Additionally media folder structure can indicate third party apps or camera sources
Location

  • /sdcard/DCIM
  • /sdcard/Pictures
  • /sdcard/WhatsApp/Media

Forensic Value

  • provides visual timeline
  • provides GPS info
  • sometimes provides deleted images as thumbnail
Instant Messaging Apps

The third-party messaging apps store messages, media, call logs, and user metadata in private app directories, usually in SQLite databases or encrypted storage. The artifacts may include chat logs, group memberships, timestamps, and shared file references, even after deletion.
Location:

  • /data/data/com.whatsapp/databases/msgstore.db
  • /sdcard/WhatsApp/media

Forensic Value

  • Direct evidence of conversations
  • Highly relevant in criminal or civil investigations
  • Media attachments often serve as proof in any forensic case
  • Exposes communication across encrypted and non-encrypted channels
Application Data

Beyond preferences and databases, many apps create custom logs, usage traces, and artifact-rich directories containing JSON, XML, and plain-text files. These files often include crash logs, analytics pings, locally cached content, and background job histories.
Location:

  • /data/data/[app.package.name]/
  • eg : /data/data/com.instagram.android/ or /data/data/com.snapchat.android/

Forensic Value

  • uncover app usage pattern
  • exposes background activity not visible in UI
  • hidden data like caches credentials, logs or usage stats
  • examining a suspicious app
User Accounts and Google Services

Android stores information about accounts synced with device, including Google, social media, email, and app-specific logins. Account data includes login timestamps, service tokens, sync settings, and sometimes unhashed usernames or emails.
Location

  • /data/system/users/0/accounts.db
  • /data/data/com.google.android.gms/databases

Forensics Value

  • Identifies user identities and linked online services
  • Maps services used
  • reveals syncing frequency and potential data exfiltration vectors
  • supports correlation with web or cloud based investigations
Installed Apps Information

Contains all information about a device including app names, package IDs, version numbers, install times, and permission settings. It includes system and user-installed apps, offering insight into the device's overall software environment.

Location

  • /data/system/packages.xml