Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Android-Forensics-References — Curated reference for Android forensic artifacts and log paths, with links to CTF writeups, research papers, and mobile device analysis tooling. | Kitploit
Tools/GitHubGitHub/realitynet/android-forensics-references
Mobile ForensicsDigital ForensicsCTFPapers & ResearchLearning & EducationCurated ResourcesLearning Paths & Courses
GitHubrealitynet/android-forensics-references

Android-Forensics-References

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Curated reference for Android forensic artifacts and log paths, with links to CTF writeups, research papers, and mobile device analysis tooling.

View Repository
35839711 months agoReviewed by Kitploit

Android Forensics References

Last update: September 22th 2025

USERDATA Partition

"/log" folder

  • /log/wifi/iwc/iwc_dump.txt
    • Cellebrite CTF 2023 Recap: Answers on Sharon’s Android
      https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/
  • /log/netstats
  • /log/batterystats
    • Cellebrite CTF 2021 - Heisenberg's Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Artefacts of Android device power off due to depleted battery
      https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery
  • /log/recovery
  • /log/sdp_log
    • 8 Log files you can collect from iOS and Android devices
      https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/
  • /log/thermal_log
  • /log/power_off_reset_reason.txt
    • DeRR.p. Investigating Power Events on Samsung Devices
      https://thebinaryhick.blog/2024/04/07/__trashed/
    • Samsung Power Off Reset Logs
      https://www.stark4n6.com/2021/10/samsung-power-off-reset-logs.html
    • 8 Log files you can collect from iOS and Android devices
      https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/
    • Cellebrite CTF 2021 - Heisenberg's Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • Artefacts of Android device power off due to depleted battery
      https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py

"/misc" and "/misc_de" folder

  • /misc/adb/adb_keys
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • aLEAPP plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py
  • /misc/bluedroiddump/mainBuffer.log
    • Investigating Evidence of Mobile Phone Usage by Drivers in Road Traffic Accidents
      https://dfrws.org/sites/default/files/session-files/2015_EU_paper-investigating_evidence_of_mobile_phone_usage_by_drivers_in_road_traffic_accidents.pdf
    • Forensic Analysis of Wireless Networking Evidence of Android Smartphones
      https://andriotisp.github.io/assets/pdf/wifs12andrio.pdf
  • /misc/bluedroiddump/subBuffer.log
    • Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones
      https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/
  • /misc/bluedroid/bt_config.conf
    • How Android Bluetooth Connections Can Determine If The Hands of a Driver Were On The Wheel During An Accident
      https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/
      https://dfir.pubpub.org/pub/6ysxvhvc/release/1
    • Android Bluetooth Connection Configuration
      https://www.stark4n6.com/2021/06/android-bluetooth-connection.html
    • Android Bluetooth
      http://forensafe.com/blogs/Android_Bluetooth.html

"/property" folder

  • /property/persistent_properties
    • Wipeout! Detecting Android Factory Resets
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • aLEAPP plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py

"/system", "/system_ce" and "/system_de" folders

  • /system/appops/
    • Snooping on Android 12’s Privacy Dashboard
      https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py
  • /system/batteryusagestats/
  • /system/job/jobs.xml
  • /system/netstats/
    • Burn After Reading: Expunging Execution Footprints of Android Apps
      https://lijuanru.com/publications/nss18.pdf
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/procstats/
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
  • /system/sync/accounts.xml
    • Who is the owner of the mobile device?
      https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/
    • Clockin’ In with Google’s Wear OS

"/user_de" folder

  • /user_de/0/com.android.bluetooth/bonddevice.db
    • Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones
      https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
  • /user_de/0/com.android.providers.telephony/databases/telephony.db
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2024
      https://cts-forensics.com/reports/24-5550_Web.pdf
    • Cellebrite CTF 2021 - Heisenberg's Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Mo’ SIMs, Mo’ Problems. Examining Phones with Dual SIMs.
      https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Cellebrite CTF 2021 Writeup

"/data" folder

Google Digital Wellbeing (com.google.android.apps.wellbeing)

  • /data/com.google.android.apps.wellbeing/databases/app_usage
    • Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity.
      https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device
      https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/
    • Investigating Android Digital Wellbeing
      https://forensafe.com/blogs/androidDigitalWellbeing.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Reconstructing Distracted Driving – Texting While Driving Forensics
      https://buntingdigitalforensics.us/insights/reconstructing-distraction/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/wellbeing.py

Samsung Digital Wellbeing (com.samsung.forest)

  • /data/com.samsung.forest/databases/dwbCommon.db
    • Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity.
      https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/
    • (Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing
      https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Investigating Android Digital Wellbeing
      https://forensafe.com/blogs/androidDigitalWellbeing.html
    • Cellebrite CTF 2023 Recap: Answers on Sharon’s Android
      https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/swellbeing.py

Google Docs (com.google.android.apps.docs)

  • /data/com.google.android.apps.docs/databases/cello.db
    • Google Docs - Cello & DocList DBs
      https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html
    • Android Google Drive
      https://forensafe.com/blogs/AndroidGoogleDrive.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Cello.py
  • /data/com.google.android.apps.docs/databases/DocList.db
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py
    • Google Docs - Cello & DocList DBs
      https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html
    • Android Google Drive
      https://forensafe.com/blogs/AndroidGoogleDrive.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Digital Forensic Investigation of Cloud Storage Services
      https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf
    • Android Cloud Forensics - Final Findings
      http://obrienforensics.blogspot.com/2014/04/final-findings.html
    • Digital Evidence Identification on Google Drive in Android Device Using NIST Mobile Forensic Method
      https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf

Files by Google (com.google.android.apps.nbu.files)

  • /data/com.google.android.apps.nbu.files/databases/files_master_database
    • Files By Google: More Mobile Explorer Artifacts
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py
  • /data/com.google.android.apps.nbu.files/databases/search_history_database
    • Files By Google: More Mobile Explorer Artifacts
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py
  • /data/com.google.android.apps.nbu.files/databases/search_history_database
    • Files By Google: More Mobile Explorer Artifacts
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py
  • /data/com.google.android.apps.nbu.files/databases/search_history_database
    • Files By Google: More Mobile Explorer Artifacts
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py

Device Health Services (com.google.android.apps.turbo)

  • /data/com.google.android.apps.turbo/databases/turbo.db
    • Charging Battery with Turbo DB
      https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html
    • Part 2: CTF 2022 Write Up – Heisenberg’s Android
      https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet User Summit 2023 CTF - Android (Part 2)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html
    • Investigating Android Device Health Services
      https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html
    • Turbo Speed: Parsing Device Health Services from Google
      https://dfir.pubpub.org/pub/4can3p40/release/1
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py
  • /data/com.google.android.apps.turbo/databases/bluetooth.db
    • Turbo Strikes Again - Tracking Bluetooth Device Battery
      https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device

Device Personalization Services (DPS) (com.google.android.as)

  • /data/com.google.android.as/databases/reflection_gel_events.db
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Walking the Android (time)line Part 2 – Using Android’s Device Personalization Services to timeline user activity
      https://thebinaryhick.blog/2020/05/16/walking-the-android-timeline-part-2-using-androids-device-personalization-services-to-timeline-user-activity/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/usageapps.py
  • /data/com.google.android.as/databases/SimpleStorage
    • Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device
      https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/SimpleStorage_applaunch.py

Settings Services (com.google.android.settings.intelligence)

  • /data/com.google.android.settings.intelligence/databases/battery-usage-db-v4
    • Application Battery Usage via Settings Services
      https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html
    • Examining A Malware-Infected Android Phone. This Android Is Not Alright.
      https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • Magnet User Summit 2023 CTF - Android (Part 1)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py
  • /data/com.google.android.settings.intelligence/databases/battery-usage-db-v9
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v9.py
  • /data/com.google.android.settings.intelligence/shared_prefs/setup_wizard_info.xml
    • Wipeout! Detecting Android Factory Resets
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html

Google Play Service (com.google.android.gms)

  • /data/com.google.android.gms/app_semanticlocation_rawsignal_db
    • The Green Look Back. Android’s On-Device Location History
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appSemloc.py
  • /data/com.google.android.gms/app_semanticlocation_placeindex_cache
    • The Green Look Back. Android’s On-Device Location History
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
  • /data/com.google.android.gms/app_semanticlocation_odlh_cache
    • The Green Look Back. Android’s On-Device Location History
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
  • /data/com.google.android.gms/databases/cast.db
    • An Android Casting (Device) Story: "cast.db"
      https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googleCast.py
  • /data/com.google.android.gms/databases/constellation.db
    • Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/

Google Play Store (com.android.vending)

  • /data/com.android.vending/databases/data_usage.db
    • Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications
      https://link.springer.com/article/10.1007/s12243-022-00919-6
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.android.vending/databases/frosting.db
    • Analysis of application installation logs on Android systems
      https://dl.acm.org/doi/10.1145/3297280.3297489
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py
  • /data/com.android.vending/databases/install_queue.db
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html

Google Quick Search (com.google.android.googlequicksearchbox)

  • Google Search & Personal Assistant data on android
    http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html
  • Google Search Bar & Search Term History – Are You Finding Everything?
    https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/
  • Forensic Investigation of Google Assistant
    https://link.springer.com/article/10.1007/s42979-020-00285-x
  • How Android Bluetooth Connections Can Determine if a Driver had Their Hands on the Wheel During an Accident
    https://dfir.pubpub.org/pub/6ysxvhvc/release/1
  • Collaborative Testing Services - Mobile Digital Evidence - 2016
    https://cts-forensics.com/reports/36550_Web.pdf
  • DroidForensics: Accurate Reconstruction of Android Attacks via Multi-layer Forensic Logging
    https://kyuhlee.github.io/publications/asiaccs17.pdf
  • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
    https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
  • Magnet User Summit 2023 CTF - Android (Part 2)
    https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py

Google Services Framework (com.google.android.gsf)

  • /data/com.google.android.gsf/databases/gservices.db
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gsf/databases/googlesettings.db
    • Forensic Analysis of Wireless Networking Evidence of Android Smartphones
      https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py

Messages (com.google.android.apps.messaging)

  • /data/com.google.android.apps.messaging/databases/bugle_db
    • Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Android Messaging Forensics – SMS/MMS and Beyond
      https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet User Summit 2023 CTF - Android (Part 1)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMessages.py
  • /data/com.google.android.apps.messaging/shared_prefs/sim_state_tracker.xml
    • Magnet Virtual Summit 2025 CTF - Android/b>
      https://www.stark4n6.com/2025/03/magnet-virtual-summit-2025-ctf-android.html

Samsung One UI Home (com.sec.android.app.launcher)

  • Recreate Android apps, folders, and widget screen positions from a forensic extraction
    https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html

Android Contacts Storage (com.android.providers.contacts)

  • /data/com.android.providers.contacts/databases/calllog.db
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Calllog.db and SMS data on Android 7.0 Nougat
      https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html
Download Tool
  • Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network
    https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/
  • Android System Artifacts: Forensic Analysis of Device Information and Usage
    https://belkasoft.com/android-system-artifacts-device
  • Collaborative Testing Services - Mobile Digital Evidence - 2015
    https://cts-forensics.com/reports/35550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2016
    https://cts-forensics.com/reports/36550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2017
    https://cts-forensics.com/reports/37550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2019
    https://cts-forensics.com/reports/19-5550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2020
    https://cts-forensics.com/reports/20-5550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2021
    https://cts-forensics.com/reports/21-5550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2022
    https://cts-forensics.com/reports/22-5550_Web.pdf
  • Collaborative Testing Services - Mobile Digital Evidence - 2024
    https://cts-forensics.com/reports/24-5550_Web.pdf
  • Cellebrite CTF 2021 Writeup
    https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
  • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
    https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
  • Cellebrite CTF 2021 - Heisenberg's Android
    https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
  • Cellebrite CTF 2022 - Heisenberg's Android
    https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html
  • Investigating Android Bluetooth
    https://forensafe.com/blogs/Android_Bluetooth.html
  • aLEAPP plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py
  • /misc/bootstat/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py
  • /misc/wifi/qtables.json
  • /misc/wifi/wpa_supplicant.conf
    /misc/wifi/WifiConfigStore.xml
    /misc/apexdata/com.android.wifi/WifiConfigStore.xml
    • Collaborative Testing Services - Mobile Digital Evidence - 2015
      https://cts-forensics.com/reports/35550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Cellebrite Fall 2020 CTF - Part 1 - Tony Mederos
      https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html
    • Clockin’ In with Google’s Wear OS
      https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/
    • Learning Android Forensics - Second Edition
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • Dissecting the Android WiFiConfigStore.xml for forensic analysis
      https://blog.digital-forensics.it/2024/02/dissecting-android-wificonfigstorexml.html
    • Investigating Android Wi-Fi Information
      https://forensafe.com/blogs/Android_wifi_Information.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore2.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py
  • /misc/wifi/softap.conf
    /misc/apexdata/com.android.wifi/WifiConfigStoreSoftAp.xml
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Let's solve challenges - Cellebrite 2022 CTF Writeup
      https://www.dfirblog.com/cellebrite-2022-ctf-writeup/
    • Cellebrite CTF 2022 - Heisenberg's Android
      https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html
    • Let's solve challenges - Cellebrite 2022 CTF Writeup
      https://www.dfirblog.com/cellebrite-2022-ctf-writeup/
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • /misc_de/0/apexdata/com.android.permission/runtime-permissions.xml
    • Android’s “Dangerous” Permissions
      https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/
    • Android - Roles and Permissions (Android 10/11)
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • Examining A Malware-Infected Android Phone. This Android Is Not Alright.
      https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py
  • /misc_de/0/apexdata/com.android.permission/roles.xml
    • Android - Roles and Permissions (Android 10/11)
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • Android’s “Dangerous” Permissions
      https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet Virtual Summit 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • 2024 Magnet Virtual Summit CTF Walkthrough
      https://m-brumbelow.github.io/posts/MVS2024CTF/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py

    https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/
  • Super Sunday Funday Forensic Challenge - Update 4
    https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html
  • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • /system/shutdown-checkpoints/
    • Shutdown Checkpoints in Android 12
      https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py
  • /system/users/0.xml
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Forensic analysis of IoT ecosystem
      https://hal.archives-ouvertes.fr/hal-03369836/document
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/users/0/app_idle_stats.xml
  • /system/users/0/settings_global.xml
    • Analysis of Android settings during a forensic investigation
      https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
  • /system/users/0/settings_secure.xml
    • Cellebrite CTF 2021 - Heisenberg's Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Examining A Malware-Infected Android Phone. This Android Is Not Alright.
      https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/
    • Analysis of Android settings during a forensic investigation
      https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
    • Magnet User Summit 2023 CTF - Android (Part 1)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py
  • /system/users/0/settings_ssaid.xml
    • Forensic analysis of instant messengers: Decrypt Signal, Wickr, and Threema
      https://www.sciencedirect.com/science/article/pii/S2666281722000166
    • Investigating Android Wickr
      https://forensafe.com/blogs/Android_Wickr.html
  • /system/users/0/settings_system.xml
    • Android - Roles and Permissions (Android 10/11)
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • Analysis of Android settings during a forensic investigation
      https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/users/service/data/eRR.p
    • DeRR.p. Investigating Power Events on Samsung Devices
      https://thebinaryhick.blog/2024/04/07/__trashed/
    • Wipeout! Detecting Android Factory Resets
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Comparison, Evolution and Challenges of Mobile Phone Batteries in Forensic Study of Role of a Mobile Battery of an Android Xiaomi Phone
      https://www.jetir.org/papers/JETIR2408628.pdf
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/errp.py
  • /system/appops.xml
    • Snooping on Android 12’s Privacy Dashboard
      https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/
    • Wipeout! Detecting Android Factory Resets
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py
    • Digital Forensic Practices and Methodologies for AI Speaker Ecosystems
      https://www.sciencedirect.com/science/article/pii/S1742287619301628
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/batterystats.bin
    • Video Aficionado: We Know What You Are Watching
      https://par.nsf.gov/servlets/purl/10215810
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Comparison, Evolution and Challenges of Mobile Phone Batteries in Forensic Study of Role of a Mobile Battery of an Android Xiaomi Phone
      https://www.jetir.org/papers/JETIR2408628.pdf
  • /system/batterystats-checkin.bin
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/batterystats-daily.xml
    • Every Step You Take: Application and Network Usage in Android
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
  • /system/deviceidle.xml
  • /system/locksettings.db
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • New Year Challenge CyberTalents CTF 2025|Forensics Writeup
      https://medium.com/@SIGMA_001/new-year-challenge-cybertalents-ctf-2025-forensics-writeup-dd5c46e126c4
  • /system/netpolicy.xml
    • Cellebrite CTF 2021 - Heisenberg's Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Cellebrite CTF 2021 Writeup
      https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
  • /system/notification_policy.xml
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Forensic Analysis of Android Notifications' History
      https://ieeexplore.ieee.org/document/10679344
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py
  • /system/PkgPredictions.db
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/pkgPredictions.py
  • /system/SemWifiApContentProvider
    • Part 2: CTF 2022 Write Up – Heisenberg’s Android
      https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/
  • /system/SimCard.dat
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • /system/WifiConfigStore.db
  • /system/WifiHistory.db
  • /system/wifigeofence.db
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
  • /system/packages.xml
    • Android - Roles and Permissions (Android 10/11)
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Mobile Forensics: Discovering the Undiscovered
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • Some artifacts in the /data/system/ directory
      http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py
  • /system/packages.list
    • Android - Roles and Permissions (Android 10/11)
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Learning Android Forensics - Second Edition
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • Learning Android Forensics - Second Edition
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py
  • /system_ce/0/accounts_ce.db
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2023
      https://cts-forensics.com/reports/23-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2024
      https://cts-forensics.com/reports/24-5550_Web.pdf
    • Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Android - Tracking Device Migration
      https://blog.d204n6.com/2021/06/android-tracking-device-migration.html
    • Magnet User Summit 2023 CTF - Android (Part 1)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Magnet Virtual Summit 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Investigating Android Accounts
      https://forensafe.com/blogs/Android_Accounts.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py
  • /system_ce/notification_history/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Forensic Analysis of Android Notifications' History
      https://ieeexplore.ieee.org/document/10679344
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/notificationHistory.py
  • /system_ce/recent_images/
    • Mobile Forensics: Discovering the Undiscovered
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android Recent Tasks XML Parser
      https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html
    • Every Step You Take: Application and Network Usage in Android
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • Digital Forensic Practices and Methodologies for AI Speaker Ecosystems
      https://www.sciencedirect.com/science/article/pii/S1742287619301628
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py
  • /system_ce/recent_tasks/
    • Mobile Forensics: Discovering the Undiscovered
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Android Recent Tasks XML Parser
      https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Digital Forensic Practices and Methodologies for AI Speaker Ecosystems
      https://www.sciencedirect.com/science/article/pii/S1742287619301628
    • Corroboration. That Is All.
      https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/
    • Every Step You Take: Application and Network Usage in Android
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • Write-up Magnet Weekly CTF
      https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py
  • /system_ce/shortcuts/
  • /system_ce/snapshots/
    • Corroboration. That Is All.
      https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/
    • Android Recent Tasks XML Parser
      https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html
    • Mobile Forensics: Discovering the Undiscovered
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet Virtual Summit 2022 CTF - Android
      https://www.stark4n6.com/2022/05/magnet-virtual-summit-2022-ctf-android.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py
  • /system_ce/usagestats/
    • Android Usagestats XML Parser
      https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html
    • Identifying the Android Operating System Version thru UsageStats
      https://www.sans.org/white-papers/40265/
    • Usagestats on Android 10 (Q)
      http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html
    • Mobile Forensics: Discovering the Undiscovered
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Some artifacts in the /data/system/ directory
      http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html
    • Android Dumpsys Analysis to Indicate Driver Distraction
      https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf
    • Every Step You Take: Application and Network Usage in Android
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • Tracking traces of deleted applications
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
    • Android version without the build.props file
      https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Magnet User Summit 2023 CTF - Android (Part 1)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Android Internals
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py
  • /system_de/0/accounts_de.db
    • Android - Tracking Device Migration
      https://blog.d204n6.com/2021/06/android-tracking-device-migration.html
    • Clockin’ In with Google’s Wear OS
      https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Investigating Android Accounts
      https://forensafe.com/blogs/Android_Accounts.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet User Summit 2023 CTF - Android (Part 1)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Magnet Virtual Summit 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py

    https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
  • Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device
    https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/
  • Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
    https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
  • Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation 
    https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf
  • Magnet User Summit 2023 CTF - Android (Part 1)
    https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
  • Magnet Virtual Summit 2024 CTF - Android
    https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
  • 2024 Magnet Virtual Summit CTF Walkthrough
    https://m-brumbelow.github.io/posts/MVS2024CTF/
  • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/siminfo.py
  • /user_de/0/com.android.settings/databases/applist.db
  • /user_de/0/com.samsung.accessibility/shared_prefs/accessibility_prefs.xml
  • /user_de/0/com.sec.imsservice/shared_prefs/capdiscovery_0.xml
  • Collaborative Testing Services - Mobile Digital Evidence - 2017
    https://cts-forensics.com/reports/37550_Web.pdf
  • Proposed Method for Mobile Forensics Investigation Analysis of Remnant Data on Google Drive Client
    https://jit.ndhu.edu.tw/article/download/1795/1801
  • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py
  • Investigating Android Device Health Services
    https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html
  • Turbo Speed: Parsing Device Health Services from Google
    https://dfir.pubpub.org/pub/4can3p40/release/1
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py
  • /data/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml
    • Turbo Pt. 3 - Device Health Services Application Usage
      https://www.stark4n6.com/2021/06/turbo-application-usage.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android System Artifacts: Forensic Analysis of Device Information and Usage
      https://belkasoft.com/android-system-artifacts-device
    • Turbo Speed: Parsing Device Health Services from Google
      https://dfir.pubpub.org/pub/4can3p40/release/1
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/setupWizardinfo.py
  • /data/com.google.android.settings.intelligence/shared_prefs/suggestions.xml
    • Wipeout! Detecting Android Factory Resets
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/suggestions.py
  • A first look at Android 14 forensics
    https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/gass.db
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py
  • /data/com.google.android.gms/databases/gms.notifications.db
  • /data/com.google.android.gms/databases/google_account_history.db
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/google_app_measurement.db
    • Forensics on Android Applications
      https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&sequence=1
    • Forensic Analysis of the Bumble Dating App for Android
      https://www.mdpi.com/2673-6756/2/1/16/htm
  • /data/com.google.android.gms/databases/herrevad
    • HERREVAD Databases Geo Location Artefacts
      http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html
    • Update - HERREVAD Databases Geo Location Artefacts
      http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html
    • Update2 - HERREVAD Databases Geo Location Artefacts
      http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html
    • Update3 - HERREVAD Databases Geo Location Artefacts
      http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
  • /data/com.google.android.gms/databases/icing_contacts.db
    • Recovering data from broken screen Android phone - alternative
      https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/icing_mmssms.db
    • Cellebrite-icing_mmssms.db-Parser
      https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md
    • Android Messaging Forensics – SMS/MMS and Beyond
      https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/
  • /data/data/com.google.android.gms/databases/MdpSimBasedDatabase
    • Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/NetworkUsage.db
    • Providing Context to the Clues: Recovery and Reliability of Location Data from Android Devices
      https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=2353&context=etd
  • /data/com.google.android.gms/databases/ns.db
  • /data/com.google.android.gms/databases/reminders.db
    • Smart Speakers Forensics
      https://core.ac.uk/download/pdf/230544843.pdf
  • /data/com.google.android.gms/files/fcm_queued_messages.ldb
    • FCM Queued Messages on Android
      https://www.cclsolutionsgroup.com/post/fcm-queued-messages-on-android
    • Android Firebase Cloud Messaging
      https://forensafe.com/blogs/AndroidFCM.html
    • Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network
      https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/FCMQueuedMessagesDump.py
  • /data/com.google.android.gms/shared_prefs/batterystats.xml
    • Every Step You Take: Application and Network Usage in Android
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
  • /data/com.google.android.gms/shared_prefs/adid_settings.xml
  • /data/com.google.android.gms/shared_prefs/BackupAccount.xml
    • Investigating Android Accounts
      https://forensafe.com/blogs/Android_Accounts.html
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
  • /data/com.google.android.gms/shared_prefs/Checkin.xml
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Cellebrite CTF 2021 Writeup
      https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
    • Cellebrite CTF 2022 - Heisenberg's Android
      https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html
    • Investigating Android Last SIM
      https://forensafe.com/blogs/Android_Last_SIM.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/shared_prefs/nearbysharing:service:state.xml
    • Nearby Share – AirDrop for Android (Return of the Unsolicited Richard Photograph)
      https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/
  • /data/com.google.android.gms/shared_prefs/ULR_USER_PREFS.xml
    • The Green Look Back. Android’s On-Device Location History
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/ulrUserprefs.py
  • A first look at Android 14 forensics
    https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • When is an app not an app? Investigating WebAPKs on Android
    https://www.cclsolutionsgroup.com/post/when-is-an-app-not-an-app-investigating-webapks-on-android
  • Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications
    https://link.springer.com/article/10.1007/s12243-022-00919-6
  • /data/com.android.vending/databases/library.db
    • Mobile Forensics: Discovering the Undiscovered
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • Analysis of application installation logs on Android systems
      https://dl.acm.org/doi/10.1145/3297280.3297489
    • CTF Cellebrite CTF 2020: Rene Gade
      https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/
    • Tracking traces of deleted applications
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
    • Every Step You Take: Application and Network Usage in Android
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py
  • /data/com.android.vending/databases/localappstate.db
    • Analysis of application installation logs on Android systems
      https://dl.acm.org/doi/10.1145/3297280.3297489
    • Tracking traces of deleted applications
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
    • Part 2: CTF 2022 Write Up – Heisenberg’s Android
      https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/
    • Collaborative Testing Services - Mobile Digital Evidence - 2015
      https://cts-forensics.com/reports/35550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Has the user ever used the XYZ application? aka traces of application execution on mobile devices
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Investigating Android Installed Applications
      https://forensafe.com/blogs/Android_InstalledApps.html
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py
  • /data/com.android.vending/databases/package_verification.db
    • Tracking traces of deleted applications
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
  • /data/com.android.vending/databases/suggestions.db
    • Collaborative Testing Services - Mobile Digital Evidence - 2015
      https://cts-forensics.com/reports/35550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android System Artifacts: Forensic Analysis of Application Usage
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Magnet User Summit 2023 CTF - Android (Part 2)
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html
    • Magnet Virtual Summit 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • Investigating Android Playstore Search History
      https://forensafe.com/blogs/Android_PlayStoreSearch.html
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googlePlaySearches.py
  • /data/com.android.vending/databases/verify_apps.db
    • Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications
      https://link.springer.com/article/10.1007/s12243-022-00919-6

    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py

  • Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation 
    https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf
  • Call Log query
    https://github.com/kacos2000/Queries/blob/master/calllog_db.sql
  • A first look at Android 14 forensics
    https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • Investigating Android Call logs
    https://forensafe.com/blogs/Android_Call_logs.html
  • Investigating Android SMS
    https://forensafe.com/blogs/AndroidSMS.html
  • How to Uncover Application Artifacts for Mobile Device Investigations
    https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
  • Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones
    https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/
  • Learning Android Forensics - Second Edition
    https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
  • Practical Mobile Forensics - Fourth Edition
    https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • aLEAPP Plugin
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py
  • /data/com.android.providers.contacts/databases/contacts2.db
    • Open Source Mobile Device Forensics
      https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - Mobile Digital Evidence - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation 
      https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf
    • Contacts query
      https://github.com/kacos2000/Queries/blob/master/contacts2.sql
    • Contacts calls query
      https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql
    • Learning Android Forensics - Second Edition
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • A first look at Android 14 forensics
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Investigating Android Contacts
      https://forensafe.com/blogs/Android_Contacts.html
    • How to Uncover Application Artifacts for Mobile Device Investigations
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Practical Mobile Forensics - Fourth Edition
      https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP Plugin
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py
  • /data/com.android.providers.contacts/files/photos/
    • Collaborative Testing Services - Mobile Digital Evidence - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf

    Android Messaging Storage (com.android.providers.telephony)

    • /data/user_de/0/com.android.providers.telephony/databases/mmssms.db
      /data/com.android.providers.telephony/databases/mmssms.db
      • Android Messaging Forensics – SMS/MMS and Beyond
        https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/
      • Android mmssms.db each table introduction
        https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2

        • Read more