ᛉ Yggdrasil

Android

Android Forensics

15 Sep 2026 · 5,049 words · 23 min

Contents

Legend: [ACQUIRE] = Data acquisition | [ROOT] = Root access | [ALEAPP] = ALEAPP tool | [AUTOPSY] = Autopsy platform | [BACKUP] = Backup analysis | [ADB] = ADB technique | [ARTIFACT] = Digital artifact | [CHAIN] = Chain of custody

1. Tools & Methodology Overview

What it means: Android forensics is the science of recovering, preserving, and analyzing digital evidence from Android devices in a legally defensible manner. The methodology must maintain integrity — evidence must be provably unmodified — and follow a strict order of volatility (most volatile data first).

1.1 Forensic Methodology

┌──────────────────────────────────────────────────────────────────┐  
│ ANDROID FORENSICS METHODOLOGY                                    │  
│                                                                  │  
│ 1. SEIZURE & PRESERVATION                                        │  
│ ├── Enable airplane mode (prevent remote wipe)                   │  
│ ├── Do NOT unlock (biometric may be used once)                   │  
│ ├── Faraday bag (block RF signals → prevent remote wipe)         │  
│ ├── Document device state (on/off, screen content)               │  
│ └── Photograph device before touching                            │  
│                                                                  │  
│ 2. IDENTIFICATION                                                │  
│ ├── Device model, IMEI, serial number                            │  
│ ├── Android version, build number                                │  
│ ├── SIM card information                                         │  
│ └── Installed apps, screen lock type                             │  
│                                                                  │  
│ 3. ACQUISITION (order of volatility)                             │  
│ ├── RAM dump (most volatile — loses on reboot)                   │  
│ ├── Logical acquisition (file system via ADB)                    │  
│ ├── Physical acquisition (full flash dump)                       │  
│ └── Cloud acquisition (Google account data)                      │  
│                                                                  │  
│ 4. EXAMINATION & ANALYSIS                                        │  
│ ├── ALEAPP (artifact parsing)                                    │  
│ ├── Autopsy (full investigation platform)                        │  
│ ├── Manual artifact review                                       │  
│ └── Timeline reconstruction                                      │  
│                                                                  │  
│ 5. REPORTING                                                     │  
│ ├── Chain of custody documentation                               │  
│ ├── Hash verification (MD5/SHA256)                               │  
│ ├── Findings with evidence references                            │  
│ └── Expert witness-ready report                                  │  
└──────────────────────────────────────────────────────────────────┘

1.2 Acquisition Methods Comparison

Method What You Get Root Needed Evidence Integrity
──────────────────────────────────────────────────────────────────────────────
Logical (ADB) App data + media Sometimes MEDIUM
File System /data partition YES (root) HIGH
Physical Full NAND flash dump YES HIGHEST
JTAG Raw flash chip dump Hardware HIGHEST
Chip-off Direct NAND read Hardware HIGHEST
Cloud Google/Drive backup Credentials MEDIUM
Backup (.ab) App + media backup No MEDIUM

1.3 Forensic Toolset

Tool Purpose Platform
──────────────────────────────────────────────────────────────────
ALEAPP Parse Android artifacts Windows/Linux/Mac
Autopsy Full forensic investigation Windows/Linux
ADB Device interaction/extraction Cross-platform
Magnet AXIOM Commercial forensic suite Windows
Cellebrite Physical + logical acquisition Windows (hardware)
TWRP Custom recovery for acquisition Device (root)
Magisk Root management + acquisition Device
adb backup Logical backup acquisition Cross-platform
Android-Backup-Extractor .ab file extraction Cross-platform

2. Rooting Android Devices

What it means: Rooting grants superuser (root) access to the Android operating system — essential for forensic acquisition because app private data in /data/data/ is inaccessible without it. In forensics, rooting is done on COPIES of evidence or on devices where the investigative goal justifies the modification.

2.1 Why Root is Required in Forensics

Without Root:
├── /data/data// → Permission denied
├── /data/system/ → Permission denied
├── /data/misc/ → Permission denied
├── Contacts database → Inaccessible
├── SMS database → Inaccessible
└── App private files → Inaccessible

With Root:
├── /data/data// → Full access (passwords, tokens, DBs)
├── /data/system/ → Full access (accounts, packages)
├── /data/misc/ → Full access (WiFi passwords, etc.)
├── Contacts database → Read /data/data/com.android.providers.contacts/
├── SMS database → Read /data/data/com.android.providers.telephony/
└── All app private files→ Complete extraction

2.2 Rooting Methods

Method How It Works Forensic Impact
──────────────────────────────────────────────────────────────────────
TWRP + Magisk Boot custom recovery → flash Modifies /boot partition
Magisk ZIP → root installed Documents: date/time change

Bootloader unlock OEM unlock → custom recovery Triggers factory reset!
→ Magisk flash WIPES DATA — only if needed

Exploit-based CVE exploit for device model Minimal system changes
(e.g., DirtyCOW, Wen) Best for forensics

ADB root adb root (debug builds only) Only works if
→ runs adb as root ro.debuggable=1

Forensic boot Custom boot image + ramdisk Minimal device impact
(e.g., Oxygen Forensics boot) Best practice

2.3 TWRP — Team Win Recovery Project

# ─── TWRP for forensic acquisition ───

# Step 1: Check bootloader status
adb shell getprop ro.boot.flash.locked
# 0 = unlocked, 1 = locked

# Step 2: Unlock bootloader (WARNING: MAY WIPE DATA)
adb reboot bootloader
fastboot oem unlock        # older devices
fastboot flashing unlock   # newer devices

# Step 3: Flash TWRP
fastboot flash recovery twrp-<version>-<device>.img
fastboot reboot recovery

# Step 4: In TWRP → Advanced → ADB Sideload OR:
# Mount → enable ADB → extract /data partition

# Step 5: Forensic acquisition via TWRP
# TWRP → Backup → select partitions:
# ├── Data (userdata) ← most important!
# ├── System
# ├── Boot
# └── Save to /sdcard/ or external storage

# Step 6: Pull backup via ADB
adb pull /sdcard/TWRP/BACKUPS/ ./evidence/

# ─── Hash evidence files immediately! ───
sha256sum evidence/data.win  > evidence/data.win.sha256
md5sum    evidence/data.win  > evidence/data.win.md5

2.4 Exploit-Based Rooting (Minimal Footprint)

# ─── Check Android version for known exploits ───
adb shell getprop ro.build.version.release
adb shell getprop ro.build.version.security_patch

# Known exploits by version:
# Android 5.x-6.x  → Towelroot, KingRoot
# Android 7.x      → DirtyCOW (CVE-2016-5195)
# Android 8.x-9.x  → Various kernel exploits
# Android 10+      → Requires unlocked bootloader usually

# ─── ADB root (eng/debug builds) ───
adb root         # restarts ADB daemon as root
adb shell whoami # should return: root

# ─── Verify root access ───
adb shell "su -c 'id'"
# uid=0(root) gid=0(root) → root confirmed

# ─── Test data access ───
adb shell "su -c 'ls /data/data/com.android.providers.telephony/databases/'"
# Should list: mmssms.db, telephony.db → SMS database!

2.5 Forensic Considerations When Rooting

⚠️ CRITICAL: Document EVERYTHING before and after rooting
├── Hash /data partition BEFORE rooting
├── Note current timestamp on device
├── Record: model, IMEI, Android version, build
├── Photograph device (physical state)
└── Note any existing modifications (already rooted?)

⚠️ Changes rooting makes (document in report):
├── /boot partition modified (Magisk)
├── System partition may be modified
├── New files added: su binary, Magisk modules
└── Timestamps on some system files changed

⚠️ Best practice:
└── Work on forensic copy / image if possible
NEVER modify original evidence without documentation

3. Root Management Apps

What it means: Root management apps control which apps get root access, log root usage, and provide forensic investigators with visibility into what processes have been using root — itself valuable forensic evidence of unauthorized privilege escalation.

3.1 Magisk — The Modern Root Solution

# ─── What Magisk does ───
# Systemless root: modifies /boot instead of /system
# MagiskHide/DenyList: hides root from specific apps
# Magisk Modules: add functionality without changing /system
# Zygisk: in-process root management

# ─── Forensic value of Magisk logs ───
adb shell "su -c 'cat /data/adb/magisk/magisk.log'"
# Shows: all root requests, grants, denials with timestamps

adb shell "su -c 'ls /data/adb/magisk/'"
# Structure:
# /data/adb/
# ├── magisk/          ← Magisk installation
# ├── modules/         ← installed modules (forensic interest!)
# ├── post-fs-data.d/  ← startup scripts
# └── service.d/       ← service scripts

# ─── Check Magisk module list (forensic) ───
adb shell "su -c 'ls /data/adb/modules/'"
# Suspicious modules:
# ├── keylogger/       ← VERY suspicious
# ├── spyware/         ← malicious
# ├── ssl_bypass/      ← certificate bypass installed
# └── systemless_hosts/← ad blocking (benign)

# ─── Magisk database (tracks app permissions) ───
adb shell "su -c 'sqlite3 /data/adb/magisk.db \".dump\"'"
# policies table: shows which apps were granted root
# Columns: uid, package_name, policy (allow/deny), until, logging, notification

3.2 SuperSU

# ─── Older root management (pre-Magisk era) ───

# SuperSU log location
adb shell "su -c 'cat /data/data/eu.chainfire.supersu/databases/su.db'"
# OR pull the database
adb shell "su -c 'cp /data/data/eu.chainfire.supersu/databases/su.db /sdcard/'"
adb pull /sdcard/su.db ./evidence/

# Query su.db
sqlite3 su.db
> .tables
# logs: app_name, uid, date, time, action (allow/deny), command
> SELECT * FROM logs ORDER BY date DESC;
# → Shows full history of who requested root, when, what command!
> SELECT * FROM apps;
# → Shows which apps have standing root grant

3.3 Forensic Value of Root Logs

What root logs reveal in an investigation:
├── Timeline of root access attempts
├── Which apps have been granted root (privilege escalation evidence)
├── Commands run as root (malicious activity)
├── Timestamps correlated with incident timeline
├── Evidence of tampering with device
└── Presence of unauthorized root tools

Key queries for Magisk database:

-- Pull from: /data/adb/magisk.db

-- Who has root access?
SELECT package_name, policy, until
FROM policies
WHERE policy = 2  -- 2 = ALLOW
ORDER BY package_name;

-- Full root grant history
SELECT uid, package_name, policy,
       datetime(until, 'unixepoch') as expiry,
       logging, notification
FROM policies;

-- Check for suspicious packages with root
SELECT package_name, policy
FROM policies
WHERE package_name NOT IN (
  'com.topjohnwu.magisk',  -- Magisk itself
  'com.android.shell'       -- ADB shell
);
-- Any other app with root → investigate!

4. Data Acquisition Methods

What it means: Acquisition is the process of collecting digital evidence from an Android device in a forensically sound manner — preserving integrity, maintaining chain of custody, and minimizing alteration of evidence.

4.1 Logical Acquisition via ADB

# ─── Enable ADB (if device is accessible) ───
# Settings → Developer Options → USB Debugging

# ─── Connect and verify ───
adb devices
# Serial number + "device" = authorized

# ─── Hash before acquisition ───
adb shell "su -c 'find /data -type f -exec md5sum {} \;' > /sdcard/pre_hash.txt"
adb pull /sdcard/pre_hash.txt ./evidence/

# ─── Pull entire /data/data (requires root) ───
adb shell "su -c 'cp -r /data/data /sdcard/data_backup/'"
adb pull /sdcard/data_backup/ ./evidence/data/

# ─── Pull specific app data ───
PKG="com.whatsapp"
adb shell "su -c 'cp -r /data/data/$PKG /sdcard/app_backup/'"
adb pull /sdcard/app_backup/ ./evidence/$PKG/

# ─── Pull key databases directly ───
# SMS/MMS
adb shell "su -c 'cp /data/data/com.android.providers.telephony/databases/mmssms.db /sdcard/'"
adb pull /sdcard/mmssms.db ./evidence/

# Contacts
adb shell "su -c 'cp /data/data/com.android.providers.contacts/databases/contacts2.db /sdcard/'"
adb pull /sdcard/contacts2.db ./evidence/

# Call log
adb shell "su -c 'cp /data/data/com.android.providers.contacts/databases/calllog.db /sdcard/'"
adb pull /sdcard/calllog.db ./evidence/

# WhatsApp messages
adb shell "su -c 'cp /data/data/com.whatsapp/databases/msgstore.db /sdcard/'"
adb pull /sdcard/msgstore.db ./evidence/

# ─── Pull all media ───
adb pull /sdcard/DCIM/    ./evidence/photos/
adb pull /sdcard/Download/ ./evidence/downloads/
adb pull /sdcard/WhatsApp/ ./evidence/whatsapp_media/

4.2 Physical Acquisition via DD

# ─── Full physical acquisition (requires root) ───

# Step 1: Find the userdata partition
adb shell "su -c 'cat /proc/partitions'"
adb shell "su -c 'ls -la /dev/block/by-name/'" 
# Look for: userdata, data → typically mmcblk0p{n}

# Step 2: Get partition size
adb shell "su -c 'blockdev --getsize64 /dev/block/by-name/userdata'"
# Output: bytes size of partition

# Step 3: DD image over ADB (large device!)
# Method A: pull via ADB
adb shell "su -c 'dd if=/dev/block/by-name/userdata bs=512'" \
  | dd of=./evidence/userdata.img bs=512
# This streams the raw partition image to your machine!

# Method B: DD to SD card then pull
adb shell "su -c 'dd if=/dev/block/by-name/userdata of=/sdcard/userdata.img bs=4096'"
adb pull /sdcard/userdata.img ./evidence/

# Step 4: Hash the image IMMEDIATELY
sha256sum ./evidence/userdata.img > ./evidence/userdata.img.sha256
md5sum    ./evidence/userdata.img > ./evidence/userdata.img.md5
echo "Image acquired: $(date)" >> ./evidence/chain_of_custody.txt

# Step 5: Mount and analyze image
mkdir -p /mnt/android_data
mount -t ext4 -o ro,noexec ./evidence/userdata.img /mnt/android_data
ls /mnt/android_data/

4.3 ADB Backup Acquisition (No Root)

# ─── Backup without root ───
# Works if: USB debugging enabled + device unlocked

# Full backup of all apps + media
adb backup -all -apk -shared -nosystem -f full_backup.ab
# User must confirm "Back up my data" on device screen!

# Backup specific app
adb backup -apk -f whatsapp_backup.ab com.whatsapp

# Options:
# -all      → all apps
# -apk      → include APK files
# -shared   → include shared/external storage
# -nosystem → exclude system apps
# -noapk    → exclude APK files (data only)

# ─── Hash immediately ───
sha256sum full_backup.ab > full_backup.ab.sha256

5. ALEAPP — Android Logs Events and Protobuf Parser

What it means: ALEAPP (Android Logs Events and Protobuf Parser) is a free, open- source forensic artifact parser specifically built for Android. It processes hundreds of artifact types — app databases, system logs, location data, account info, browser history — and generates an organized HTML report with all findings, making it the go-to tool for rapid Android artifact triage.

5.1 Installation & Setup

# ─── Install ALEAPP ───
git clone https://github.com/abrignoni/ALEAPP.git
cd ALEAPP
pip3 install -r requirements.txt

# ─── Verify ───
python3 aleapp.py --help

# ─── Also available as Windows EXE ───
# Download: https://github.com/abrignoni/ALEAPP/releases
# → aleapp.exe (no Python needed)

5.2 Running ALEAPP

# ─── Input types ALEAPP accepts ───
# 1. TAR/ZIP of extracted /data directory
# 2. ADB backup (.ab file)
# 3. Directory of extracted files
# 4. Filesystem image (mounted or extracted)

# ─── Method 1: From extracted /data directory ───
python3 aleapp.py \
  -t dir \
  -i /path/to/extracted/data/ \
  -o /path/to/output/

# ─── Method 2: From ADB backup file ───
# First extract .ab to directory (see Section 7)
# Then run ALEAPP on extracted directory
python3 aleapp.py \
  -t tar \
  -i backup_extracted/ \
  -o aleapp_report/

# ─── Method 3: From filesystem image ───
# Mount image first
sudo mount -t ext4 -o ro userdata.img /mnt/android/
python3 aleapp.py \
  -t dir \
  -i /mnt/android/ \
  -o aleapp_report/

# ─── Method 4: GUI mode ───
python3 aleappGUI.py
# → Select input type → browse to file/folder → select output → Process!

# ─── Output ───
# aleapp_report/
# ├── index.html        ← OPEN THIS! Full interactive report
# ├── _Timeline/        ← timeline CSV files
# ├── tsv/              ← tab-separated data files
# └── <artifact_name>/  ← individual artifact folders

5.3 ALEAPP Artifact Categories

ALEAPP parses 200+ artifact types across categories:

┌──────────────────────────────────────────────────────────────────┐  
│ CATEGORY ARTIFACTS PARSED                                        │  
│ ─────────────────────────────────────────────────────────────    │  
│ ACCOUNTS Google accounts, Samsung accounts                       │  
│ Account credentials, sync data                                   │  
│                                                                  │  
│ APPS Installed apps list + timestamps                            │  
│ App permissions granted                                          │  
│ App usage statistics                                             │  
│                                                                  │  
│ BROWSER Chrome history, bookmarks, downloads                     │  
│ Search terms, visited URLs                                       │  
│ Cookies, form data                                               │  
│                                                                  │  
│ CALLS Call log (incoming/outgoing/missed)                        │  
│ Contact names, duration, timestamps                              │  
│                                                                  │  
│ CONTACTS Contact database                                        │  
│ Email addresses, phone numbers                                   │  
│                                                                  │  
│ DEVICE INFO IMEI, serial, Android ID                             │  
│ Build info, last factory reset                                   │  
│                                                                  │  
│ LOCATION GPS history, Cell tower history                         │  
│ WiFi location data, Google Timeline                              │  
│ Frequently visited places                                        │  
│                                                                  │  
│ MEDIA Photos + metadata (EXIF = GPS!)                            │  
│ Videos, audio recordings                                         │  
│                                                                  │  
│ MESSAGING SMS/MMS database                                       │  
│ WhatsApp messages + media                                        │  
│ Telegram, Signal, Facebook Messenger                             │  
│ Instagram DMs, Snapchat                                          │  
│                                                                  │  
│ SOCIAL Facebook, Twitter/X, TikTok                               │  
│ Reddit, Discord activity                                         │  
│                                                                  │  
│ SYSTEM WiFi connection history                                   │  
│ Bluetooth devices connected                                      │  
│ Battery stats, screen unlock events                              │  
│ Recent tasks, notification history                               │  
│                                                                  │  
│ GOOGLE Google Maps searches + navigation                         │  
│ Google Assistant queries                                         │  
│ YouTube watch history                                            │  
│ Google Photos                                                    │  
└──────────────────────────────────────────────────────────────────┘

5.4 ALEAPP Report Analysis

Key report sections for investigation:

  1. Device Information
    → Establish: whose device, what model, Android version
    → IMEI, Android ID (unique device identifiers)

  2. Accounts
    → Google account = owner identity
    → Multiple accounts = shared device or suspicious

  3. App Timeline (Usage Stats)
    → When was each app used?
    → Correlate with incident timeline
    → "Was WhatsApp open at time of incident?"

  4. Location Data ← CRITICAL
    → Google Timeline = precise movement history
    → Cell tower → approximate location per hour
    → WiFi APs → location within meters
    → Photo EXIF → exact GPS when photo taken

  5. Communications
    → SMS/MMS: all messages with timestamps
    → WhatsApp: messages, calls, media shared
    → Deleted messages (if not overwritten)

  6. Browser History
    → Search queries (what was researched?)
    → Visited URLs with timestamps
    → Downloaded files

  7. Notifications History (Android 11+)
    → Notification log in /data/system/
    → Shows received messages even if app deleted

5.5 ALEAPP Key Artifact File Paths

# WhatsApp
/data/data/com.whatsapp/databases/msgstore.db          # messages
/data/data/com.whatsapp/databases/wa.db                # contacts
/sdcard/WhatsApp/Media/                                # media files
/data/data/com.whatsapp/shared_prefs/com.whatsapp.xml  # account info

# SMS/MMS
/data/data/com.android.providers.telephony/databases/mmssms.db

# Contacts
/data/data/com.android.providers.contacts/databases/contacts2.db

# Call Log
/data/data/com.android.providers.contacts/databases/calllog.db

# Chrome Browser
/data/data/com.android.chrome/app_chrome/Default/History
/data/data/com.android.chrome/app_chrome/Default/Web Data  # searches

# Google Maps
/data/data/com.google.android.apps.maps/databases/

# Gmail
/data/data/com.google.android.gm/databases/

# Photos
/data/data/com.google.android.apps.photos/databases/

# WiFi History
/data/misc/wifi/WifiConfigStore.xml
/data/misc/wifi/wpa_supplicant.conf   # older devices

# Location
/data/data/com.google.android.gms/databases/
/data/system/users/0/                  # user profiles

# App Usage Stats
/data/system/usagestats/              # per-app usage timing

# Notification History
/data/system/notification_log.db      # Android 11+

# Google Account
/data/system/sync/accounts.xml
/data/system/users/0/accounts.db

6. Autopsy — Digital Forensics Platform

What it means: Autopsy is a free, open-source digital forensics platform used by law enforcement, military, and corporate investigators worldwide. It provides a GUI over The Sleuth Kit and supports Android via the Android Analyzer module — processing filesystem images, ADB backups, and logical extractions to produce court-ready reports.

6.1 Installation & Setup

# ─── Download Autopsy ───
# https://www.autopsy.com/download/
# Windows: installer (recommended)
# Linux:   requires manual dependency install

# ─── Linux dependencies ───
sudo apt install testdisk sleuthkit

# Download Autopsy ZIP for Linux
unzip autopsy-4.x.x.zip
cd autopsy-4.x.x/
chmod +x bin/autopsy
./unix_setup.sh      # configure Java path
./bin/autopsy        # launch!

# ─── Android analysis requirements ───
# The Autopsy Android Analyzer module processes:
# ├── ADB backup files (.ab)
# ├── Logical image (folder/ZIP from adb pull)
# ├── Physical image (.img, .dd, .E01)
# └── UFED/Cellebrite output files

6.2 Creating a Case in Autopsy

Step-by-step new Android forensic case:

  1. Launch Autopsy → New Case
    ├── Case Name: "Investigation_2026_001"
    ├── Case Number: "2026-001"
    ├── Examiner: "Investigator Name"
    └── Case Directory: secure evidence folder

  2. Add Data Source
    ├── Select: "Logical Files" (for extracted folder)
    ├── OR: "Disk Image or VM File" (for .img/.dd)
    ├── OR: "Android Backup File" (for .ab)
    └── Browse to evidence file → Next

  3. Configure Ingest Modules (select all relevant):
    ├── ✅ Android Analyzer ← KEY for Android
    ├── ✅ Hash Lookup ← hash verification
    ├── ✅ File Type Identification ← identify file types
    ├── ✅ Keyword Search ← search for terms
    ├── ✅ Email Parser ← parse email data
    ├── ✅ EXIF Parser ← photo metadata
    ├── ✅ Recent Activity ← browser, docs
    ├── ✅ Encryption Detection ← find encrypted files
    └── ✅ Interesting Files ← flag suspicious files

  4. Finish → Autopsy processes evidence automatically
    Processing time: 5-30 minutes depending on size

6.3 Autopsy Android Analyzer Module

Android Analyzer automatically extracts:

Left panel categories after processing:
├── Extracted Content/
│ ├── Accounts → Google/app accounts found
│ ├── Bookmarks → Browser bookmarks
│ ├── Call Logs → All calls (incoming/outgoing)
│ ├── Contacts → Address book contacts
│ ├── Installed Programs → All installed APKs
│ ├── Messages → SMS/MMS messages
│ ├── Web History → Browser URL history
│ ├── Web Search → Search queries
│ └── GPS Tracks → Location data points
│ ├── Results/
│ ├── Keyword Hits → keyword search results
│ ├── Interesting Files → flagged suspicious files
│ ├── Encryption Suspected→ high entropy files
│ └── Hash Set Hits → known malware hashes
│ └── Views/
├── File Types/ → by extension
├── Deleted Files → recovered deleted files ← key!
└── File Size → large files

6.4 Key Investigation Workflows in Autopsy

Workflow 1: Communication Analysis
1. Extracted Content → Messages → filter by date range
2. Note: sender, recipient, content, timestamp, direction
3. Right-click → Add Tag → "Evidence" (for reporting)
4. Cross-reference: Contacts → verify identity of numbers
5. Check: Deleted messages in Deleted Files view

Workflow 2: Location Tracking
1. Extracted Content → GPS Tracks → view on map
2. EXIF Parser results → photo GPS coordinates
3. File Views → filter by date → correlate with locations
4. Export KML → open in Google Earth for visualization

Workflow 3: Browser History Investigation
1. Extracted Content → Web History → sort by date
2. Extracted Content → Web Search → keywords searched
3. Downloads folder → what was downloaded?
4. Keyword Search → search for specific terms

Workflow 4: Timeline Analysis
1. Tools → Make Timeline (top menu)
2. Select date range
3. Shows ALL file activity in chronological order:
├── Files created (app installed, photo taken)
├── Files modified (messages received)
└── Files accessed (content viewed)
4. Filter by event type or source
5. Export as CSV for reporting

6.5 Keyword Search & Tagging

Keyword Search (Ctrl+F in Autopsy):
→ Search across ALL artifacts simultaneously
→ Use for: person's name, phone number, location, keyword

Example searches for investigation:
"password" → find stored credentials
"transfer" → find financial activity
"@gmail.com" → find email addresses
"bomb" → threat-related content
"bitcoin" → cryptocurrency activity
"vpn" → network anonymization
"+91XXXXXXXXXX" → specific phone number

Tagging evidence:
Right-click artifact → Add File Tag
Tags:
├── "Evidence" → relevant to case
├── "Notable" → important finding
├── "Follow Up"→ needs further analysis
└── Custom tags you define

Report generation:
Tools → Generate Report
├── HTML Report → web-based, interactive
├── Excel Report → spreadsheet format
└── KML Report → location data for Google Earth

7. Analyzing Android Backup Files

What it means: ADB backup files (.ab) contain app data, databases, media, and optionally APKs. Even without root, investigators can acquire .ab files and extract rich forensic evidence. The .ab format is a compressed, optionally encrypted archive that requires specific tools to parse.

7.1 ADB Backup File Format

.ab file structure: 

┌──────────────────────────────────────────────────────────────┐  
│ MAGIC: "ANDROID BACKUP\n"                                    │  
│ VERSION: "4\n" (usually)                                     │  
│ COMPRESSED: "1\n" (zlib compressed) or "0\n"                 │  
│ ENCRYPTION: "none\n" OR "AES-256\n" (if password set)        │  
│ DATA: Compressed TAR stream                                  │  
│ └── Contains:                                                │  
│ ├── apps/<pkg>/db/<dbname>.db                                │  
│ ├── apps/<pkg>/sp/<prefs>.xml                                │  
│ ├── apps/<pkg>/f/<files>                                     │  
│ └── shared/<external_storage>                                │  
└──────────────────────────────────────────────────────────────┘

7.2 Extracting ADB Backup Files

# ─── Method 1: android-backup-extractor (Java tool) ───
# Download: https://github.com/nelenkov/android-backup-extractor
java -jar abe.jar unpack backup.ab backup.tar [password_if_encrypted]
tar -xvf backup.tar -C ./extracted/

# ─── Method 2: Manual extraction (Python) ───
python3 << 'EOF'
import zlib, struct, sys

with open("backup.ab", "rb") as f:
    # Skip header lines
    header = ""
    while True:
        line = f.readline().decode("utf-8", errors="ignore")
        header += line
        if line.strip() == "none":  # encryption line
            break

    print("Header:", header)
    compressed_data = f.read()

    # Decompress zlib
    decompressed = zlib.decompress(compressed_data)

    with open("backup.tar", "wb") as out:
        out.write(decompressed)
    print(f"Extracted: backup.tar ({len(decompressed)} bytes)")
EOF

tar -xvf backup.tar -C extracted/

# ─── Method 3: Android Backup Splitter ───
pip3 install android-backup-extractor
abx -o extracted/ backup.ab

# ─── Method 4: TWRP backup extraction ───
# TWRP backups → .win files → tar compressed
# Extract:
tar -xvf data.ext4.win        # uncompressed TWRP
tar -xvzf data.ext4.win.gz    # compressed TWRP
# OR
lz4 -d data.ext4.win.lz4 data.ext4.win  # LZ4 compressed
tar -xvf data.ext4.win

7.3 What's Inside a Backup — File Structure

extracted/
├── apps/
│ ├── com.whatsapp/
│ │ ├── db/
│ │ │ ├── msgstore.db ← ALL WhatsApp messages!
│ │ │ ├── wa.db ← WhatsApp contacts
│ │ │ └── axolotl.db ← encryption keys
│ │ ├── sp/
│ │ │ └── com.whatsapp_preferences.xml ← account info
│ │ └── f/
│ │ └── key ← WhatsApp encryption key
│ │
│ ├── com.android.providers.telephony/
│ │ └── db/
│ │ └── mmssms.db ← ALL SMS/MMS messages!
│ │
│ ├── com.android.providers.contacts/
│ │ └── db/
│ │ ├── contacts2.db ← all contacts
│ │ └── calllog.db ← call history
│ │
│ └── com.android.chrome/
│ └── db/
│ └── History ← Chrome browsing history
│
└── shared/ ← external storage
├── DCIM/Camera/ ← photos/videos
├── Download/ ← downloaded files
└── WhatsApp/Media/ ← WA media files

7.4 Analyzing Backup Databases

# ─── SMS/MMS Analysis ───
sqlite3 extracted/apps/com.android.providers.telephony/db/mmssms.db
> .tables
# sms, mms, threads, canonical_addresses, drafts

> SELECT address, date/1000 as timestamp, body, type
  FROM sms
  ORDER BY date DESC;
# type: 1=received, 2=sent, 3=draft, 4=outbox, 5=failed, 6=queued

> SELECT datetime(date/1000, 'unixepoch', 'localtime') as time,
         address, body, type
  FROM sms
  WHERE date > strftime('%s', '2026-01-01') * 1000
  ORDER BY date;

# ─── Call Log Analysis ───
sqlite3 extracted/apps/com.android.providers.contacts/db/calllog.db
> SELECT number,
         datetime(date/1000, 'unixepoch', 'localtime') as time,
         duration,
         type,   -- 1=incoming, 2=outgoing, 3=missed
         geocoded_location
  FROM calls
  ORDER BY date DESC;

# ─── WhatsApp Message Analysis ───
sqlite3 extracted/apps/com.whatsapp/db/msgstore.db
> .tables
# messages, chat_list, jid, group_participants, media_refs

> SELECT m.timestamp/1000 as time,
         j.raw_string as contact,
         m.data as message_text,
         m.status  -- 0=received, 1=sent
  FROM messages m
  JOIN jid j ON m.key_remote_jid = j.raw_string
  ORDER BY m.timestamp DESC
  LIMIT 100;

# ─── Chrome History Analysis ───
sqlite3 extracted/apps/com.android.chrome/db/History
> SELECT url, title,
         datetime(last_visit_time/1000000-11644473600, 'unixepoch') as visit_time,
         visit_count
  FROM urls
  ORDER BY last_visit_time DESC;

# ─── Contacts Analysis ───
sqlite3 extracted/apps/com.android.providers.contacts/db/contacts2.db
> SELECT display_name, data1 as value, mimetype
  FROM data d
  JOIN raw_contacts rc ON d.raw_contact_id = rc._id
  JOIN mimetypes mt ON d.mimetype_id = mt._id
  WHERE mimetype IN ('vnd.android.cursor.item/phone_v2',
                     'vnd.android.cursor.item/email_v2')
  ORDER BY display_name;

7.5 Encrypted Backup Handling

# ─── If backup is AES-256 encrypted ───
# Header shows: "AES-256\n" instead of "none\n"

# Method 1: android-backup-extractor with password
java -jar abe.jar unpack encrypted_backup.ab decrypted.tar "password123"
tar -xvf decrypted.tar -C extracted/

# Method 2: Brute force if password unknown
# Using ab2tar (Python script) + wordlist
python3 ab2tar.py -i encrypted_backup.ab -w /usr/share/wordlists/rockyou.txt
# This tries each password in rockyou.txt

# Method 3: Key extraction from memory (if device still on)
# frida → hook javax.crypto.SecretKey → capture backup encryption key

# ─── Verify backup integrity ───
sha256sum backup.ab
# Compare with documented hash from acquisition
# If hashes match → backup unmodified since acquisition

8. Key Artifact Locations

8.1 Critical Evidence Locations

# ══════════════════════════════════
# COMMUNICATIONS
# ══════════════════════════════════
SMS/MMS:
  /data/data/com.android.providers.telephony/databases/mmssms.db

Call Log:
  /data/data/com.android.providers.contacts/databases/calllog.db

Contacts:
  /data/data/com.android.providers.contacts/databases/contacts2.db

WhatsApp (requires root):
  /data/data/com.whatsapp/databases/msgstore.db        # messages
  /data/data/com.whatsapp/databases/wa.db              # contacts
  /sdcard/WhatsApp/Databases/msgstore.db.crypt14       # cloud backup

Telegram:
  /data/data/org.telegram.messenger/files/cache4.db

Signal:
  /data/data/org.thoughtcrime.securesms/databases/signal.db

# ══════════════════════════════════
# BROWSER ACTIVITY
# ══════════════════════════════════
Chrome History:
  /data/data/com.android.chrome/app_chrome/Default/History
Chrome Downloads:
  /data/data/com.android.chrome/app_chrome/Default/History (downloads table)
Chrome Cookies:
  /data/data/com.android.chrome/app_chrome/Default/Cookies

Firefox:
  /data/data/org.mozilla.firefox/files/mozilla/<profile>/places.sqlite

# ══════════════════════════════════
# LOCATION
# ══════════════════════════════════
Google Maps History:
  /data/data/com.google.android.apps.maps/databases/gmm_myplaces.db
  /data/data/com.google.android.apps.maps/databases/da_destination_history

WiFi Connection History:
  /data/misc/wifi/WifiConfigStore.xml
  /data/misc/wifi/wpa_supplicant.conf

Cell Tower Data:
  /data/data/com.google.android.gms/databases/

# ══════════════════════════════════
# ACCOUNT & IDENTITY
# ══════════════════════════════════
Google Accounts:
  /data/system/sync/accounts.xml
  /data/system/users/0/accounts.db

Device ID:
  /data/system/users/0/settings_ssaid.xml   # SSAID
  adb shell settings get secure android_id  # Android ID

# ══════════════════════════════════
# SYSTEM & ACTIVITY
# ══════════════════════════════════
App Usage Statistics:
  /data/system/usagestats/

Installed Apps + Timestamps:
  /data/system/packages.xml

Recent Tasks (thumbnails):
  /data/system_ce/0/recent_tasks/

Notification History (Android 11+):
  /data/system/notification_log.db

Battery Stats:
  /data/system/batterystats.bin

Screen Unlock Events:
  /data/system/locksettings.db

9. Cheat Sheet

Full Forensic Acquisition Checklist

# 1. Document & hash
adb shell getprop ro.serialno
adb shell getprop ro.product.model
adb shell getprop ro.build.version.release
date                               # acquisition timestamp

# 2. Acquire
adb backup -all -apk -shared -f backup_$(date +%Y%m%d).ab
sha256sum backup_*.ab > backup.sha256   # hash immediately!

# 3. Extract backup
java -jar abe.jar unpack backup.ab backup.tar
mkdir extracted && tar -xvf backup.tar -C extracted/

# 4. Run ALEAPP
python3 aleapp.py -t dir -i extracted/ -o aleapp_report/
# Open: aleapp_report/index.html

# 5. Open in Autopsy
# New Case → Add Data Source → extracted/ folder
# Enable: Android Analyzer + all relevant modules → Finish

# 6. Key DB queries
sqlite3 extracted/apps/com.android.providers.telephony/db/mmssms.db \
  "SELECT datetime(date/1000,'unixepoch','localtime'),address,body FROM sms ORDER BY date DESC" \
  | head -50

# 7. Generate report
# Autopsy: Tools → Generate Report → HTML → Include tagged items

Critical Forensic SQL Queries

-- Recent SMS (last 100)
SELECT datetime(date/1000,'unixepoch','localtime') as time,
       address, body,
       CASE type WHEN 1 THEN 'RECEIVED' WHEN 2 THEN 'SENT' ELSE 'OTHER' END as direction
FROM sms ORDER BY date DESC LIMIT 100;

-- Call log summary
SELECT number,
       datetime(date/1000,'unixepoch','localtime') as time,
       duration || ' sec' as duration,
       CASE type WHEN 1 THEN 'INCOMING' WHEN 2 THEN 'OUTGOING' WHEN 3 THEN 'MISSED' END as type
FROM calls ORDER BY date DESC LIMIT 50;

-- WhatsApp messages
SELECT datetime(timestamp/1000,'unixepoch','localtime') as time,
       key_remote_jid as contact,
       data as message,
       CASE status WHEN 0 THEN 'RECEIVED' WHEN 5 THEN 'SENT' END as direction
FROM messages ORDER BY timestamp DESC LIMIT 100;

-- Chrome history
SELECT datetime(last_visit_time/1000000-11644473600,'unixepoch','localtime') as time,
       url, title, visit_count
FROM urls ORDER BY last_visit_time DESC LIMIT 50;

Tool Quick Reference

Task Command/Tool
────────────────────────────────────────────────────────────────
Acquire backup adb backup -all -apk -shared -f evidence.ab
Extract .ab java -jar abe.jar unpack evidence.ab evidence.tar
Parse artifacts python3 aleapp.py -t dir -i extracted/ -o report/
Full investigation Autopsy → New Case → Add Data Source
SMS analysis sqlite3 mmssms.db "SELECT * FROM sms"
WhatsApp messages sqlite3 msgstore.db "SELECT * FROM messages"
Call logs sqlite3 calllog.db "SELECT * FROM calls"
Chrome history sqlite3 History "SELECT * FROM urls"
Location data ALEAPP report → GPS Tracks section
App usage timeline ALEAPP report → App Usage Statistics
Hash evidence sha256sum evidence.ab > evidence.ab.sha256

Evidence Priority Matrix

Priority Artifact Volatility Tool
──────────────────────────────────────────────────────────────
CRITICAL RAM (running procs) Highest ADB + frida dump
CRITICAL SMS/WhatsApp messages High ALEAPP + Autopsy
CRITICAL Location history High ALEAPP GPS Tracks
HIGH Call logs Medium Autopsy Analyzer
HIGH Browser history Medium ALEAPP + Autopsy
HIGH Photos + EXIF Low EXIF Parser
MEDIUM App usage stats Low ALEAPP
MEDIUM WiFi history Low ALEAPP
LOW Installed apps list Very Low MobSF / Autopsy

This completes the full Android Forensics module. Your priority workflow for every investigation:

  1. Faraday bag FIRST — prevent remote wipe before anything else
  2. adb backup before rooting — get what you can without modifying the device
  3. Hash every file immediately — sha256sum every single artifact before analyzing
  4. ALEAPP for triage — 5 minutes to full HTML report → instantly see what's valuable
  5. Autopsy for deep dive — timeline analysis, deleted files recovery, keyword search
  6. SQL queries for precision — direct database queries get exact evidence faster than any GUI

The forensic evidence gold mine:

mmssms.db → All SMS conversations
msgstore.db → All WhatsApp messages
calllog.db → Every call ever made/received
History → Every website ever visited
GPS Tracks → Where the device was, when
accounts.db → Who owns the device
usagestats/ → Which apps were used and when

← Android top ↑