Android Forensics References
September 23, 2025 · View on GitHub
Last update: September 22th 2025
USERDATA Partition
"/log" folder
- /log/wifi/iwc/iwc_dump.txt
- Cellebrite CTF 2023 Recap: Answers on Sharon’s Android
https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/ - /log/netstats
- /log/batterystats
- Cellebrite CTF 2021 - Heisenberg's Android
https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Artefacts of Android device power off due to depleted battery
https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery - /log/recovery
- /log/sdp_log
- 8 Log files you can collect from iOS and Android devices
https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/ - /log/thermal_log
- /log/power_off_reset_reason.txt
- DeRR.p. Investigating Power Events on Samsung Devices
https://thebinaryhick.blog/2024/04/07/__trashed/ - Samsung Power Off Reset Logs
https://www.stark4n6.com/2021/10/samsung-power-off-reset-logs.html - 8 Log files you can collect from iOS and Android devices
https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/ - Cellebrite CTF 2021 - Heisenberg's Android
https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html - Artefacts of Android device power off due to depleted battery
https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py
"/misc" and "/misc_de" folder
- /misc/adb/adb_keys
- Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - aLEAPP plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py - /misc/bluedroiddump/mainBuffer.log
- Investigating Evidence of Mobile Phone Usage by Drivers in Road Traffic Accidents
https://dfrws.org/sites/default/files/session-files/2015_EU_paper-investigating_evidence_of_mobile_phone_usage_by_drivers_in_road_traffic_accidents.pdf - Forensic Analysis of Wireless Networking Evidence of Android Smartphones
https://andriotisp.github.io/assets/pdf/wifs12andrio.pdf - /misc/bluedroiddump/subBuffer.log
- Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones
https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/ - /misc/bluedroid/bt_config.conf
- How Android Bluetooth Connections Can Determine If The Hands of a Driver Were On The Wheel During An Accident
https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/
https://dfir.pubpub.org/pub/6ysxvhvc/release/1 - Android Bluetooth Connection Configuration
https://www.stark4n6.com/2021/06/android-bluetooth-connection.html - Android Bluetooth
http://forensafe.com/blogs/Android_Bluetooth.html - Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network
https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/ - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - Collaborative Testing Services - Mobile Digital Evidence - 2015
https://cts-forensics.com/reports/35550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - Cellebrite CTF 2021 Writeup
https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708 - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Cellebrite CTF 2021 - Heisenberg's Android
https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html - Cellebrite CTF 2022 - Heisenberg's Android
https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html - Investigating Android Bluetooth
https://forensafe.com/blogs/Android_Bluetooth.html - aLEAPP plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py - /misc/bootstat/
- aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py - /misc/wifi/qtables.json
- /misc/wifi/wpa_supplicant.conf
/misc/wifi/WifiConfigStore.xml
/misc/apexdata/com.android.wifi/WifiConfigStore.xml - Collaborative Testing Services - Mobile Digital Evidence - 2015
https://cts-forensics.com/reports/35550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - Cellebrite Fall 2020 CTF - Part 1 - Tony Mederos
https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html - Clockin’ In with Google’s Wear OS
https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/ - Learning Android Forensics - Second Edition
https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017 - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - Dissecting the Android WiFiConfigStore.xml for forensic analysis
https://blog.digital-forensics.it/2024/02/dissecting-android-wificonfigstorexml.html - Investigating Android Wi-Fi Information
https://forensafe.com/blogs/Android_wifi_Information.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore2.py
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py - /misc/wifi/softap.conf
/misc/apexdata/com.android.wifi/WifiConfigStoreSoftAp.xml - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Let's solve challenges - Cellebrite 2022 CTF Writeup
https://www.dfirblog.com/cellebrite-2022-ctf-writeup/ - Cellebrite CTF 2022 - Heisenberg's Android
https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html - Let's solve challenges - Cellebrite 2022 CTF Writeup
https://www.dfirblog.com/cellebrite-2022-ctf-writeup/ - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - /misc_de/0/apexdata/com.android.permission/runtime-permissions.xml
- Android’s “Dangerous” Permissions
https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/ - Android - Roles and Permissions (Android 10/11)
https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html - Examining A Malware-Infected Android Phone. This Android Is Not Alright.
https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py - /misc_de/0/apexdata/com.android.permission/roles.xml
- Android - Roles and Permissions (Android 10/11)
https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html - Android’s “Dangerous” Permissions
https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Magnet Virtual Summit 2024 CTF - Android
https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html - 2024 Magnet Virtual Summit CTF Walkthrough
https://m-brumbelow.github.io/posts/MVS2024CTF/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py
"/property" folder
- /property/persistent_properties
- Wipeout! Detecting Android Factory Resets
https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/ - aLEAPP plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py
"/system", "/system_ce" and "/system_de" folders
- /system/appops/
- Snooping on Android 12’s Privacy Dashboard
https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py - /system/batteryusagestats/
- /system/job/jobs.xml
- /system/netstats/
- Burn After Reading: Expunging Execution Footprints of Android Apps
https://lijuanru.com/publications/nss18.pdf - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /system/procstats/
- Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - /system/sync/accounts.xml
- Who is the owner of the mobile device?
https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/ - Clockin’ In with Google’s Wear OS
https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/ - Super Sunday Funday Forensic Challenge - Update 4
https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - /system/shutdown-checkpoints/
- Shutdown Checkpoints in Android 12
https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py - /system/users/0.xml
- Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - Forensic analysis of IoT ecosystem
https://hal.archives-ouvertes.fr/hal-03369836/document - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /system/users/0/app_idle_stats.xml
- /system/users/0/settings_global.xml
- Analysis of Android settings during a forensic investigation
https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html - /system/users/0/settings_secure.xml
- Cellebrite CTF 2021 - Heisenberg's Android
https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Examining A Malware-Infected Android Phone. This Android Is Not Alright.
https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/ - Analysis of Android settings during a forensic investigation
https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py - /system/users/0/settings_ssaid.xml
- Forensic analysis of instant messengers: Decrypt Signal, Wickr, and Threema
https://www.sciencedirect.com/science/article/pii/S2666281722000166 - Investigating Android Wickr
https://forensafe.com/blogs/Android_Wickr.html - /system/users/0/settings_system.xml
- Android - Roles and Permissions (Android 10/11)
https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html - Analysis of Android settings during a forensic investigation
https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /system/users/service/data/eRR.p
- DeRR.p. Investigating Power Events on Samsung Devices
https://thebinaryhick.blog/2024/04/07/__trashed/ - Wipeout! Detecting Android Factory Resets
https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/ - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Comparison, Evolution and Challenges of Mobile Phone Batteries in Forensic Study of Role of a Mobile Battery of an Android Xiaomi Phone
https://www.jetir.org/papers/JETIR2408628.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/errp.py - /system/appops.xml
- Snooping on Android 12’s Privacy Dashboard
https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/ - Wipeout! Detecting Android Factory Resets
https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py - Digital Forensic Practices and Methodologies for AI Speaker Ecosystems
https://www.sciencedirect.com/science/article/pii/S1742287619301628 - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /system/batterystats.bin
- Video Aficionado: We Know What You Are Watching
https://par.nsf.gov/servlets/purl/10215810 - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Comparison, Evolution and Challenges of Mobile Phone Batteries in Forensic Study of Role of a Mobile Battery of an Android Xiaomi Phone
https://www.jetir.org/papers/JETIR2408628.pdf - /system/batterystats-checkin.bin
- A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /system/batterystats-daily.xml
- Every Step You Take: Application and Network Usage in Android
https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - /system/deviceidle.xml
- /system/locksettings.db
- Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - New Year Challenge CyberTalents CTF 2025|Forensics Writeup
https://medium.com/@SIGMA_001/new-year-challenge-cybertalents-ctf-2025-forensics-writeup-dd5c46e126c4 - /system/netpolicy.xml
- Cellebrite CTF 2021 - Heisenberg's Android
https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Cellebrite CTF 2021 Writeup
https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708 - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - /system/notification_policy.xml
- Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Forensic Analysis of Android Notifications' History
https://ieeexplore.ieee.org/document/10679344 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py - /system/PkgPredictions.db
- Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/pkgPredictions.py - /system/SemWifiApContentProvider
- Part 2: CTF 2022 Write Up – Heisenberg’s Android
https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/ - /system/SimCard.dat
- Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - /system/WifiConfigStore.db
- /system/WifiHistory.db
- /system/wifigeofence.db
- Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - /system/packages.xml
- Android - Roles and Permissions (Android 10/11)
https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Mobile Forensics: Discovering the Undiscovered
https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/ - Some artifacts in the /data/system/ directory
http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py - /system/packages.list
- Android - Roles and Permissions (Android 10/11)
https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - Learning Android Forensics - Second Edition
https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017 - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - Learning Android Forensics - Second Edition
https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py - /system_ce/0/accounts_ce.db
- Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2023
https://cts-forensics.com/reports/23-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Android - Tracking Device Migration
https://blog.d204n6.com/2021/06/android-tracking-device-migration.html - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Magnet Virtual Summit 2024 CTF - Android
https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Investigating Android Accounts
https://forensafe.com/blogs/Android_Accounts.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py - /system_ce/notification_history/
- A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Forensic Analysis of Android Notifications' History
https://ieeexplore.ieee.org/document/10679344 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/notificationHistory.py - /system_ce/recent_images/
- Mobile Forensics: Discovering the Undiscovered
https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/ - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Android Recent Tasks XML Parser
https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html - Every Step You Take: Application and Network Usage in Android
https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html - Digital Forensic Practices and Methodologies for AI Speaker Ecosystems
https://www.sciencedirect.com/science/article/pii/S1742287619301628 - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py - /system_ce/recent_tasks/
- Mobile Forensics: Discovering the Undiscovered
https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/ - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Android Recent Tasks XML Parser
https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Digital Forensic Practices and Methodologies for AI Speaker Ecosystems
https://www.sciencedirect.com/science/article/pii/S1742287619301628 - Corroboration. That Is All.
https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/ - Every Step You Take: Application and Network Usage in Android
https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - Write-up Magnet Weekly CTF
https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py - /system_ce/shortcuts/
- /system_ce/snapshots/
- Corroboration. That Is All.
https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/ - Android Recent Tasks XML Parser
https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html - Mobile Forensics: Discovering the Undiscovered
https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/ - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Magnet Virtual Summit 2022 CTF - Android
https://www.stark4n6.com/2022/05/magnet-virtual-summit-2022-ctf-android.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py - /system_ce/usagestats/
- Android Usagestats XML Parser
https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html - Identifying the Android Operating System Version thru UsageStats
https://www.sans.org/white-papers/40265/ - Usagestats on Android 10 (Q)
http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html - Mobile Forensics: Discovering the Undiscovered
https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/ - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Some artifacts in the /data/system/ directory
http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html - Android Dumpsys Analysis to Indicate Driver Distraction
https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf - Every Step You Take: Application and Network Usage in Android
https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html - Tracking traces of deleted applications
https://www.youtube.com/watch?v=4LcQm4ErXpA
https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html - Android version without the build.props file
https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Android Internals
http://newandroidbook.com/Book/2-Excerpt-Data.pdf - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py - /system_de/0/accounts_de.db
- Android - Tracking Device Migration
https://blog.d204n6.com/2021/06/android-tracking-device-migration.html - Clockin’ In with Google’s Wear OS
https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/ - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - Investigating Android Accounts
https://forensafe.com/blogs/Android_Accounts.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Magnet Virtual Summit 2024 CTF - Android
https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py
"/user_de" folder
- /user_de/0/com.android.bluetooth/bonddevice.db
- Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones
https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/ - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - /user_de/0/com.android.providers.telephony/databases/telephony.db
- Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - Cellebrite CTF 2021 - Heisenberg's Android
https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Mo’ SIMs, Mo’ Problems. Examining Phones with Dual SIMs.
https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/ - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Cellebrite CTF 2021 Writeup
https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708 - Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device
https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/ - Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/ - Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation
https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Magnet Virtual Summit 2024 CTF - Android
https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html - 2024 Magnet Virtual Summit CTF Walkthrough
https://m-brumbelow.github.io/posts/MVS2024CTF/ - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/siminfo.py - /user_de/0/com.android.settings/databases/applist.db
- /user_de/0/com.samsung.accessibility/shared_prefs/accessibility_prefs.xml
- /user_de/0/com.sec.imsservice/shared_prefs/capdiscovery_0.xml
"/data" folder
Google Digital Wellbeing (com.google.android.apps.wellbeing)
- /data/com.google.android.apps.wellbeing/databases/app_usage
- Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity.
https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/ - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device
https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/ - Investigating Android Digital Wellbeing
https://forensafe.com/blogs/androidDigitalWellbeing.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - Reconstructing Distracted Driving – Texting While Driving Forensics
https://buntingdigitalforensics.us/insights/reconstructing-distraction/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/wellbeing.py
Samsung Digital Wellbeing (com.samsung.forest)
- /data/com.samsung.forest/databases/dwbCommon.db
- Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity.
https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/ - (Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing
https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/ - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - Investigating Android Digital Wellbeing
https://forensafe.com/blogs/androidDigitalWellbeing.html - Cellebrite CTF 2023 Recap: Answers on Sharon’s Android
https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/swellbeing.py
Google Docs (com.google.android.apps.docs)
- /data/com.google.android.apps.docs/databases/cello.db
- Google Docs - Cello & DocList DBs
https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html - Android Google Drive
https://forensafe.com/blogs/AndroidGoogleDrive.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Cello.py - /data/com.google.android.apps.docs/databases/DocList.db
- aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py - Google Docs - Cello & DocList DBs
https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html - Android Google Drive
https://forensafe.com/blogs/AndroidGoogleDrive.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Digital Forensic Investigation of Cloud Storage Services
https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf - Android Cloud Forensics - Final Findings
http://obrienforensics.blogspot.com/2014/04/final-findings.html - Digital Evidence Identification on Google Drive in Android Device Using NIST Mobile Forensic Method
https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Proposed Method for Mobile Forensics Investigation Analysis of Remnant Data on Google Drive Client
https://jit.ndhu.edu.tw/article/download/1795/1801 - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py
Files by Google (com.google.android.apps.nbu.files)
- /data/com.google.android.apps.nbu.files/databases/files_master_database
- Files By Google: More Mobile Explorer Artifacts
https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py - /data/com.google.android.apps.nbu.files/databases/search_history_database
- Files By Google: More Mobile Explorer Artifacts
https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py - /data/com.google.android.apps.nbu.files/databases/search_history_database
- Files By Google: More Mobile Explorer Artifacts
https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py - /data/com.google.android.apps.nbu.files/databases/search_history_database
- Files By Google: More Mobile Explorer Artifacts
https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py
Device Health Services (com.google.android.apps.turbo)
- /data/com.google.android.apps.turbo/databases/turbo.db
- Charging Battery with Turbo DB
https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html - Part 2: CTF 2022 Write Up – Heisenberg’s Android
https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/ - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Magnet User Summit 2023 CTF - Android (Part 2)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html - Investigating Android Device Health Services
https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html - Turbo Speed: Parsing Device Health Services from Google
https://dfir.pubpub.org/pub/4can3p40/release/1 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py - /data/com.google.android.apps.turbo/databases/bluetooth.db
- Turbo Strikes Again - Tracking Bluetooth Device Battery
https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - Investigating Android Device Health Services
https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html - Turbo Speed: Parsing Device Health Services from Google
https://dfir.pubpub.org/pub/4can3p40/release/1 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py - /data/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml
- Turbo Pt. 3 - Device Health Services Application Usage
https://www.stark4n6.com/2021/06/turbo-application-usage.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - Turbo Speed: Parsing Device Health Services from Google
https://dfir.pubpub.org/pub/4can3p40/release/1 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py
Device Personalization Services (DPS) (com.google.android.as)
- /data/com.google.android.as/databases/reflection_gel_events.db
- Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - Walking the Android (time)line Part 2 – Using Android’s Device Personalization Services to timeline user activity
https://thebinaryhick.blog/2020/05/16/walking-the-android-timeline-part-2-using-androids-device-personalization-services-to-timeline-user-activity/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/usageapps.py - /data/com.google.android.as/databases/SimpleStorage
- Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device
https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/SimpleStorage_applaunch.py
Settings Services (com.google.android.settings.intelligence)
- /data/com.google.android.settings.intelligence/databases/battery-usage-db-v4
- Application Battery Usage via Settings Services
https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html - Examining A Malware-Infected Android Phone. This Android Is Not Alright.
https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/ - Android System Artifacts: Forensic Analysis of Device Information and Usage
https://belkasoft.com/android-system-artifacts-device - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py
- /data/com.google.android.settings.intelligence/databases/battery-usage-db-v9
- A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v9.py - /data/com.google.android.settings.intelligence/shared_prefs/setup_wizard_info.xml
- Wipeout! Detecting Android Factory Resets
https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/setupWizardinfo.py - /data/com.google.android.settings.intelligence/shared_prefs/suggestions.xml
- Wipeout! Detecting Android Factory Resets
https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/suggestions.py
Google Play Service (com.google.android.gms)
- /data/com.google.android.gms/app_semanticlocation_rawsignal_db
- The Green Look Back. Android’s On-Device Location History
https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appSemloc.py - /data/com.google.android.gms/app_semanticlocation_placeindex_cache
- The Green Look Back. Android’s On-Device Location History
https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/ - /data/com.google.android.gms/app_semanticlocation_odlh_cache
- The Green Look Back. Android’s On-Device Location History
https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/ - /data/com.google.android.gms/databases/cast.db
- An Android Casting (Device) Story: "cast.db"
https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googleCast.py - /data/com.google.android.gms/databases/constellation.db
- Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.google.android.gms/databases/gass.db
- Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py - /data/com.google.android.gms/databases/gms.notifications.db
- /data/com.google.android.gms/databases/google_account_history.db
- A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.google.android.gms/databases/google_app_measurement.db
- Forensics on Android Applications
https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&sequence=1 - Forensic Analysis of the Bumble Dating App for Android
https://www.mdpi.com/2673-6756/2/1/16/htm - /data/com.google.android.gms/databases/herrevad
- HERREVAD Databases Geo Location Artefacts
http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html - Update - HERREVAD Databases Geo Location Artefacts
http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html - Update2 - HERREVAD Databases Geo Location Artefacts
http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html - Update3 - HERREVAD Databases Geo Location Artefacts
http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - /data/com.google.android.gms/databases/icing_contacts.db
- Recovering data from broken screen Android phone - alternative
https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.google.android.gms/databases/icing_mmssms.db
- Cellebrite-icing_mmssms.db-Parser
https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md - Android Messaging Forensics – SMS/MMS and Beyond
https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/ - /data/data/com.google.android.gms/databases/MdpSimBasedDatabase
- Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.google.android.gms/databases/NetworkUsage.db
- Providing Context to the Clues: Recovery and Reliability of Location Data from Android Devices
https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=2353&context=etd - /data/com.google.android.gms/databases/ns.db
- /data/com.google.android.gms/databases/reminders.db
- Smart Speakers Forensics
https://core.ac.uk/download/pdf/230544843.pdf - /data/com.google.android.gms/files/fcm_queued_messages.ldb
- FCM Queued Messages on Android
https://www.cclsolutionsgroup.com/post/fcm-queued-messages-on-android - Android Firebase Cloud Messaging
https://forensafe.com/blogs/AndroidFCM.html - Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network
https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/FCMQueuedMessagesDump.py - /data/com.google.android.gms/shared_prefs/batterystats.xml
- Every Step You Take: Application and Network Usage in Android
https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - /data/com.google.android.gms/shared_prefs/adid_settings.xml
- /data/com.google.android.gms/shared_prefs/BackupAccount.xml
- Investigating Android Accounts
https://forensafe.com/blogs/Android_Accounts.html - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - /data/com.google.android.gms/shared_prefs/Checkin.xml
- Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/ - Cellebrite CTF 2021 Writeup
https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708 - Cellebrite CTF 2022 - Heisenberg's Android
https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html - Investigating Android Last SIM
https://forensafe.com/blogs/Android_Last_SIM.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.google.android.gms/shared_prefs/nearbysharing:service:state.xml
- Nearby Share – AirDrop for Android (Return of the Unsolicited Richard Photograph)
https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/ - /data/com.google.android.gms/shared_prefs/ULR_USER_PREFS.xml
- The Green Look Back. Android’s On-Device Location History
https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/ulrUserprefs.py
Google Play Store (com.android.vending)
- /data/com.android.vending/databases/data_usage.db
- Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications
https://link.springer.com/article/10.1007/s12243-022-00919-6 - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.android.vending/databases/frosting.db
- Analysis of application installation logs on Android systems
https://dl.acm.org/doi/10.1145/3297280.3297489 - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py - /data/com.android.vending/databases/install_queue.db
- Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - When is an app not an app? Investigating WebAPKs on Android
https://www.cclsolutionsgroup.com/post/when-is-an-app-not-an-app-investigating-webapks-on-android - Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications
https://link.springer.com/article/10.1007/s12243-022-00919-6 - /data/com.android.vending/databases/library.db
- Mobile Forensics: Discovering the Undiscovered
https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/ - Analysis of application installation logs on Android systems
https://dl.acm.org/doi/10.1145/3297280.3297489 - CTF Cellebrite CTF 2020: Rene Gade
https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/ - Tracking traces of deleted applications
https://www.youtube.com/watch?v=4LcQm4ErXpA
https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html - Every Step You Take: Application and Network Usage in Android
https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py - /data/com.android.vending/databases/localappstate.db
- Analysis of application installation logs on Android systems
https://dl.acm.org/doi/10.1145/3297280.3297489 - Tracking traces of deleted applications
https://www.youtube.com/watch?v=4LcQm4ErXpA
https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html - Part 2: CTF 2022 Write Up – Heisenberg’s Android
https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/ - Collaborative Testing Services - Mobile Digital Evidence - 2015
https://cts-forensics.com/reports/35550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Investigating Android Installed Applications
https://forensafe.com/blogs/Android_InstalledApps.html - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py - /data/com.android.vending/databases/package_verification.db
- Tracking traces of deleted applications
https://www.youtube.com/watch?v=4LcQm4ErXpA
https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html - /data/com.android.vending/databases/suggestions.db
- Collaborative Testing Services - Mobile Digital Evidence - 2015
https://cts-forensics.com/reports/35550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Android System Artifacts: Forensic Analysis of Application Usage
https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage - Magnet User Summit 2023 CTF - Android (Part 2)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html - Magnet Virtual Summit 2024 CTF - Android
https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html - Investigating Android Playstore Search History
https://forensafe.com/blogs/Android_PlayStoreSearch.html - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googlePlaySearches.py - /data/com.android.vending/databases/verify_apps.db
- Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications
https://link.springer.com/article/10.1007/s12243-022-00919-6
Google Quick Search (com.google.android.googlequicksearchbox)
- Google Search & Personal Assistant data on android
http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html - Google Search Bar & Search Term History – Are You Finding Everything?
https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/ - Forensic Investigation of Google Assistant
https://link.springer.com/article/10.1007/s42979-020-00285-x - How Android Bluetooth Connections Can Determine if a Driver had Their Hands on the Wheel During an Accident
https://dfir.pubpub.org/pub/6ysxvhvc/release/1 - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - DroidForensics: Accurate Reconstruction of Android Attacks via Multi-layer Forensic Logging
https://kyuhlee.github.io/publications/asiaccs17.pdf - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - Magnet User Summit 2023 CTF - Android (Part 2)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py
Google Services Framework (com.google.android.gsf)
- /data/com.google.android.gsf/databases/gservices.db
- Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - /data/com.google.android.gsf/databases/googlesettings.db
- Forensic Analysis of Wireless Networking Evidence of Android Smartphones
https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py
Messages (com.google.android.apps.messaging)
- /data/com.google.android.apps.messaging/databases/bugle_db
- Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/ - Android Messaging Forensics – SMS/MMS and Beyond
https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMessages.py - /data/com.google.android.apps.messaging/shared_prefs/sim_state_tracker.xml
- Magnet Virtual Summit 2025 CTF - Android/b>
https://www.stark4n6.com/2025/03/magnet-virtual-summit-2025-ctf-android.html
Samsung One UI Home (com.sec.android.app.launcher)
- Recreate Android apps, folders, and widget screen positions from a forensic extraction
https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html
Android Contacts Storage (com.android.providers.contacts)
- /data/com.android.providers.contacts/databases/calllog.db
- Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/ - Calllog.db and SMS data on Android 7.0 Nougat
https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html - Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation
https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf - Call Log query
https://github.com/kacos2000/Queries/blob/master/calllog_db.sql - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Investigating Android Call logs
https://forensafe.com/blogs/Android_Call_logs.html - Investigating Android SMS
https://forensafe.com/blogs/AndroidSMS.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones
https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/ - Learning Android Forensics - Second Edition
https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017 - Practical Mobile Forensics - Fourth Edition
https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520 - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py - /data/com.android.providers.contacts/databases/contacts2.db
- Open Source Mobile Device Forensics
https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation
https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf - Contacts query
https://github.com/kacos2000/Queries/blob/master/contacts2.sql - Contacts calls query
https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql - Learning Android Forensics - Second Edition
https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017 - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Investigating Android Contacts
https://forensafe.com/blogs/Android_Contacts.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Practical Mobile Forensics - Fourth Edition
https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520 - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py - /data/com.android.providers.contacts/files/photos/
- Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf
Android Messaging Storage (com.android.providers.telephony)
- /data/user_de/0/com.android.providers.telephony/databases/mmssms.db
/data/com.android.providers.telephony/databases/mmssms.db - Android Messaging Forensics – SMS/MMS and Beyond
https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/ - Android mmssms.db each table introduction
https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2 - Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/ - Cellebrite CTF 2022 - Heisenberg's Android
https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html - Investigating Android SMS
https://forensafe.com/blogs/AndroidSMS.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Has the user ever used the XYZ application? aka traces of application execution on mobile devices
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html - How to Uncover Application Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/ - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - Learning Android Forensics - Second Edition
https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017 - Practical Mobile Forensics - Fourth Edition
https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520 - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smsmms.py - /data/com.android.providers.telephony/databases/app_parts/
- Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
Android Calendar Storage (com.android.providers.calendar)
- /data/com.android.providers.calendar/databases/calendar.db
- Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2017
https://cts-forensics.com/reports/37550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2019
https://cts-forensics.com/reports/19-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2020
https://cts-forensics.com/reports/20-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Magnet User Summit 2023 CTF - Android (Part 1)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleCalendar.py - /data/data/com.google.android.calendar/databases/cal_v2a
- A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Collaborative Testing Services - Mobile Digital Evidence - 2022
https://cts-forensics.com/reports/22-5550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleCalendar.py
Android Download Provider (com.android.providers.downloads)
- /data/com.android.providers.downloads/databases/downloads.db
- Investigating Android Downloads
https://forensafe.com/blogs/Android_Downloads.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Collaborative Testing Services - Mobile Digital Evidence - 2016
https://cts-forensics.com/reports/36550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - spy vs. spy: examining spyware on mobile devices
https://media.defcon.org/DEF%20CON%2020/DEF%20CON%2020%20presentations/DEF%20CON%2020%20-%20Robinson-Spy-vs-Spy.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/downloads.py
Android Media Storage
- /data/com.google.android.providers.media.module/databases/external.db
- Android’s external.db – Everything Old Is New Again
https://thebinaryhick.blog/2020/10/19/androids-external-db-everything-old-is-new-again/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Investigating Android Scoped Storage
https://forensafe.com/blogs/AndroidScopedStorage.html - How to Uncover Media Artifacts for Mobile Device Investigations
https://www.magnetforensics.com/blog/how-to-uncover-media-artifacts-for-mobile-device-investigations/ - The Role of external.db in Android Forensics
https://findingtrouble.medium.com/the-role-of-external-db-in-android-forensics-53087f048864 - Magnet User Summit 2023 CTF - Android (Part 2)
https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html - Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/emulatedSmeta.py
Android Logs Provider (com.sec.android.provider.logsprovider)
- /data/com.sec.android.provider.logsprovider/databases/logs.db
- Android Messaging Forensics – SMS/MMS and Beyond
https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/ - Logs provider query
https://github.com/kacos2000/Queries/blob/master/logs_db.sql - Collaborative Testing Services - Mobile Digital Evidence - 2015
https://cts-forensics.com/reports/35550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2018
https://cts-forensics.com/reports/38550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllogs.py
Android Location (com.google.android.location)
- /data/com.google.android.location/files/cache.cell/cache.wifi
/data/com.google.android.location/files/cache.cell/cache.cell - Decoding cache.cell and cache.wifi files
https://forensics.spreitzenbarth.de/2011/10/28/decoding-cache-cell-and-cache-wifi-files/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/cachelocation.py
Android Auto (com.google.android.projection.gearhead)
- /data/com.google.android.projection.gearhead/databases/carservicedata.db
- How Android Bluetooth Connections Can Determine If The Hands of a Driver Were On The Wheel During An Accident
https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/
https://dfir.pubpub.org/pub/6ysxvhvc/release/1 - Auto-Parser: Android Auto and Apple CarPlay Forensics
https://www.researchgate.net/publication/360577665_Auto-Parser_Android_Auto_and_Apple_CarPlay_Forensics_Auto-Parser_Android_Auto_and_Apple_CarPlay_Forensics - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/androidauto.py
GBoard Google Keyboard (com.google.android.inputmethod.latin)
- /data/com.google.android.inputmethod.latin/databases/trainingcache*.db
- Gboard has some interesting data..
https://www.swiftforensics.com/2021/01/gboard-has-some-interesting-data.html - Investigating Android Gboard
https://forensafe.com/blogs/AndroidGBoard.html - OMGboard
https://kibaffo33.data.blog/2022/06/05/omgboard/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py
- /data/com.google.android.inputmethod.latin/databases/gboard_clipboard.db
- Gboard and Clipboard History
https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html - Investigating Android Gboard
https://forensafe.com/blogs/AndroidGBoard.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py - /data/com.google.android.inputmethod.latin/files/clipboard_image/
- Gboard and Clipboard History
https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py
Google Meet (com.google.android.apps.tachyon)
- /data/com.google.android.apps.tachyon/databases/tachyon.db
- Google Duo - Android & iOS Forensic Analysis
https://www.stark4n6.com/2021/08/google-duo-android-ios-forensic-analysis.html - Investigating Android Google Meet
https://www.forensafe.com/blogs/android-google-meet.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleDuo.py
Google Keep - Notes and lists (com.google.android.apps.tachyon)
- /data/com.google.android.keep/databases/keep.db
- Google Duo - Android & iOS Forensic Analysis
https://www.stark4n6.com/2021/08/google-duo-android-ios-forensic-analysis.html - Investigating Android Google Keep
https://www.forensafe.com/blogs/AndroidGoogleKeep.html - Google Keep - Notes and Lists: Mobile Artifacts
https://blog.bi0s.in/2021/06/18/Forensics/Google-Keep-Notes-and-Lists-Mobile-Artifacts/ - Google Keep - Notes and Lists: Mobile Artifacts
https://g4rud4.gitlab.io/2021/Google-Keep-Notes-and-Lists-Mobile-Artifacts/ - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleKeepNotes.py - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/keepNotes.py
Google Tasks (com.google.android.apps.tasks)
- /data/com.google.android.apps.tasks/files/tasks-*/data.db
- Google Tasks - Android Forensics analysis
https://g4rud4.gitlab.io/2021/Google-Tasks-Android-Forensics-analysis/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleTasks.py
Google Maps (com.google.android.apps.maps)
- /data/com.google.android.apps.maps/app_tts-cache/
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - At the roundabout, take the second exit…
https://kibaffo33.data.blog/2021/12/30/at-the-roundabout-take-the-second-exit/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlemapaudio.py - /data/com.google.android.apps.maps/app_tts-temp/
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlemapaudioTemp.py - /data/com.google.android.apps.maps/databases/gmm_myplaces.db
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - Decoding Android Google Maps : gmm_myplaces.db
https://segumarc.com/2023/12/15/decoding-android-google-maps-gmm_myplaces-db/ - Collaborative Testing Services - Mobile Digital Evidence - 2023
https://cts-forensics.com/reports/23-5550_Web.pdf - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py - /data/com.google.android.apps.maps/databases/gmm_storage.db
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - Magnet Virtual Summit 2024 CTF - Android
https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py - /data/com.google.android.apps.maps/databases/gmm_sync.db
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - Investigating Android Google Maps
https://forensafe.com/blogs/Android-GoogleMaps.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py - /data/com.google.android.apps.maps/files/new_recent_history_cache_search.cs
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - Collaborative Testing Services - Mobile Digital Evidence - 2024
https://cts-forensics.com/reports/24-5550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsSearches.py - /data/com.google.android.apps.maps/files/saved_directions.data.cs
- Finding Phones With Google Maps Part 1 (Android)
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/ - Collaborative Testing Services - Mobile Digital Evidence - 2021
https://cts-forensics.com/reports/21-5550_Web.pdf - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleLastTrip.py
Google Photos (com.google.android.apps.photos)
- /data/com.google.android.apps.photos/databases/gphotos*.db*
- Investigating Android Google Photos
https://forensafe.com/blogs/AndroidGooglePhotos.html - A first look at Android 14 forensics
https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlePhotos.py - /data/com.google.android.apps.photos/databases/disk_cache*
- Investigating Android Google Photos
https://forensafe.com/blogs/AndroidGooglePhotos.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlePhotos.py - /com.google.android.apps.photos/databases/local_trash.db
- Dumpster Diving in Google Photos Android App: "local_trash.db"
https://deagler4n6blog.blogspot.com/2021/01/dumpster-diving-in-google-photos-android-app.html - Investigating Android Google Photos
https://forensafe.com/blogs/AndroidGooglePhotos.html
Samsung My Files (com.sec.android.app.myfiles)
- /data/com.sec.android.app.myfiles/databases/myfiles.db
- Android - Samsung My Files App
https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyFiles.py - /data/com.sec.android.app.myfiles/databases/FileInfo.db
- /data/com.sec.android.app.myfiles/databases/FileCache.db
Samsung Gallery (com.sec.android.gallery3d)
- /data/com.sec.android.gallery3d/databases/local.db
- Mike & the Monkey Dumpster Dive Into Samsung Gallery3d App Trash
http://cheeky4n6monkey.blogspot.com/2022/01/mike-monkey-dumpster-dive-into-samsung.html - aLEAPP Plugin
https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/galleryTrash.py