Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
Android-Forensics-References — 精选的 Android 取证产物与日志路径参考，附有 CTF 题解、研究论文及移动设备分析工具的链接。 | Kitploit
工具/GitHubGitHub/realitynet/android-forensics-references
移动取证数字取证CTF论文与研究学习与教育精选资源学习路径与课程
GitHubrealitynet/android-forensics-references

Android-Forensics-References

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

精选的 Android 取证产物与日志路径参考，附有 CTF 题解、研究论文及移动设备分析工具的链接。

查看仓库
35839811个月前Kitploit 审核通过

安卓取证参考资料

最后更新：2025年9月22日

USERDATA 分区

“/log”文件夹

  • /log/wifi/iwc/iwc_dump.txt
    • Cellebrite CTF 2023 回顾：Sharon 安卓设备上的答案
      https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/
  • /log/netstats
  • /log/batterystats
    • Cellebrite CTF 2021 - 海森堡的安卓设备
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • 第 1 部分：2021 CTF 答案详解 – 调查海森堡的安卓设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • 安卓设备因电池耗尽而关机的痕迹
      https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery
  • /log/recovery
  • /log/sdp_log
    • 可从 iOS 和安卓设备收集的 8 个日志文件
      https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/
  • /log/thermal_log
  • /log/power_off_reset_reason.txt
    • DeRR.p. 调查三星设备上的电源事件
      https://thebinaryhick.blog/2024/04/07/__trashed/
    • 三星关机重置日志
      https://www.stark4n6.com/2021/10/samsung-power-off-reset-logs.html
    • 可从 iOS 和安卓设备收集的 8 个日志文件
      https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/
    • Cellebrite CTF 2021 - 海森堡的安卓设备
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • 安卓设备因电池耗尽而关机的痕迹
      https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py

“/misc”和“/misc_de”文件夹

  • /misc/adb/adb_keys
    • 安卓系统产物：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py
  • /misc/bluedroiddump/mainBuffer.log
    • 调查道路交通事故中驾驶员使用手机的证据
      https://dfrws.org/sites/default/files/session-files/2015_EU_paper-investigating_evidence_of_mobile_phone_usage_by_drivers_in_road_traffic_accidents.pdf
    • 安卓智能手机无线网络证据的取证分析
      https://andriotisp.github.io/assets/pdf/wifs12andrio.pdf
  • /misc/bluedroiddump/subBuffer.log
    • 公路之旅 – 探索三星手机上的蓝牙通话路由
      https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/
  • /misc/bluedroid/bt_config.conf
    • 安卓蓝牙连接如何帮助判定事故发生时驾驶员的手是否在方向盘上
      https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/
      https://dfir.pubpub.org/pub/6ysxvhvc/release/1
    • 安卓蓝牙连接配置
      https://www.stark4n6.com/2021/06/android-bluetooth-connection.html
    • 安卓蓝牙
      http://forensafe.com/blogs/Android_Bluetooth.html
    • 并非所有流浪的安卓设备都会迷失。探究安卓的“查找我的设备”网络
      https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/

“/property”文件夹

  • /property/persistent_properties
    • 抹除！检测安卓恢复出厂设置
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py

“/system”、“/system_ce”和“/system_de”文件夹

  • /system/appops/
    • 窥探 Android 12 的隐私面板
      https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 用户是否曾使用过 XYZ 应用？即移动设备上应用执行的痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py
  • /system/batteryusagestats/
  • /system/job/jobs.xml
  • /system/netstats/
    • 阅后即焚：抹除 Android 应用的执行足迹
      https://lijuanru.com/publications/nss18.pdf
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/procstats/
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
  • /system/sync/accounts.xml
    • 谁是移动设备的主人？
      https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/
    • 使用 Google 的 Wear OS 打卡
      https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/

"/user_de"文件夹

  • /user_de/0/com.android.bluetooth/bonddevice.db
    • Road Trippin’ – 探索三星手机上的蓝牙通话路由
      https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/
    • Collaborative Testing Services - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
  • /user_de/0/com.android.providers.telephony/databases/telephony.db
    • Collaborative Testing Services - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2024
      https://cts-forensics.com/reports/24-5550_Web.pdf
    • Cellebrite CTF 2021 - 海森堡的Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • Android系统工件：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • Android 14取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • SIM越多，问题越多。检查双卡手机。
      https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/
    • 第1部分：2021 CTF答案解读 – 调查海森堡的Android设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Cellebrite CTF 2021 解题报告
      https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708

"/data"文件夹

Google数字健康 (com.google.android.apps.wellbeing)

  • /data/com.google.android.apps.wellbeing/databases/app_usage
    • 行走在Android时间线上：利用Android的数字健康功能梳理Android活动时间线。
      https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/
    • Android系统工件：应用程序使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Android 14取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Cellebrite 2023 CTF回顾：Russell的Android设备答案
      https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/
    • 调查Android数字健康
      https://forensafe.com/blogs/androidDigitalWellbeing.html
    • 用户是否曾使用过XYZ应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • 重建分心驾驶 – 驾车发短信取证
      https://buntingdigitalforensics.us/insights/reconstructing-distraction/
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/wellbeing.py

三星数字健康 (com.samsung.forest)

  • /data/com.samsung.forest/databases/dwbCommon.db
    • 行走在Android时间线上：利用Android的数字健康功能梳理Android活动时间线。
      https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/
    • （并非）奇怪的伙伴 – 三星的Rubin与数字健康
      https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/
    • 用户是否曾使用过XYZ应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android系统工件：应用程序使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • 调查Android数字健康
      https://forensafe.com/blogs/androidDigitalWellbeing.html
    • Cellebrite 2023 CTF回顾：Sharon的Android设备答案
      https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/swellbeing.py

Google文档 (com.google.android.apps.docs)

  • /data/com.google.android.apps.docs/databases/cello.db
    • Google文档 - Cello和DocList数据库
      https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html
    • Android Google Drive
      https://forensafe.com/blogs/AndroidGoogleDrive.html
    • Android 14取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Cello.py
  • /data/com.google.android.apps.docs/databases/DocList.db
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py
    • Google文档 - Cello和DocList数据库
      https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html
    • Android Google Drive
      https://forensafe.com/blogs/AndroidGoogleDrive.html
    • Android 14取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 云存储服务的数字取证调查
      https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf
    • Android云取证 - 最终结论
      http://obrienforensics.blogspot.com/2014/04/final-findings.html
    • 使用NIST移动取证方法识别Android设备中Google Drive上的数字证据
      https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf

Files by Google (com.google.android.apps.nbu.files)

  • /data/com.google.android.apps.nbu.files/databases/files_master_database
    • Files by Google：更多移动资源管理器工件
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py
  • /data/com.google.android.apps.nbu.files/databases/search_history_database
    • Files by Google：更多移动资源管理器工件
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py
  • /data/com.google.android.apps.nbu.files/databases/search_history_database
    • Files by Google：更多移动资源管理器工件
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py
  • /data/com.google.android.apps.nbu.files/databases/search_history_database
    • Files by Google：更多移动资源管理器工件
      https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py
    • aLEAPP插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py

设备健康服务 (com.google.android.apps.turbo)

  • /data/com.google.android.apps.turbo/databases/turbo.db
    • 使用 Turbo 数据库为电池充电
      https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html
    • 第 2 部分：CTF 2022 复盘 – Heisenberg 的 Android
      https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/
    • Android 系统痕迹：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet 用户峰会 2023 CTF - Android（第 2 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html
    • 调查 Android 设备健康服务
      https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html
    • Turbo 加速：解析 Google 的设备健康服务
      https://dfir.pubpub.org/pub/4can3p40/release/1
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py
  • /data/com.google.android.apps.turbo/databases/bluetooth.db
    • Turbo 再次出击 - 追踪蓝牙设备电池
      https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html
    • Android 系统痕迹：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • 调查 Android 设备健康服务
      https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html

设备个性化服务（DPS）（com.google.android.as）

  • /data/com.google.android.as/databases/reflection_gel_events.db
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • 漫步 Android 时间线 第 2 部分 – 利用 Android 的设备个性化服务梳理用户活动时间线
      https://thebinaryhick.blog/2020/05/16/walking-the-android-timeline-part-2-using-androids-device-personalization-services-to-timeline-user-activity/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/usageapps.py
  • /data/com.google.android.as/databases/SimpleStorage
    • Cellebrite 的 CTF 2023 回顾：Russell 的 Android 设备答案解析
      https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/SimpleStorage_applaunch.py

设置服务（com.google.android.settings.intelligence）

  • /data/com.google.android.settings.intelligence/databases/battery-usage-db-v4
    • 通过设置服务查看应用电池使用情况
      https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html
    • 检查一台感染恶意软件的 Android 手机。这部 Android 不太正常。
      https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/
    • Android 系统痕迹：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • Magnet 用户峰会 2023 CTF - Android（第 1 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py
  • /data/com.google.android.settings.intelligence/databases/battery-usage-db-v9
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v9.py
  • /data/com.google.android.settings.intelligence/shared_prefs/setup_wizard_info.xml
    • 彻底清除！检测 Android 恢复出厂设置
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/setupWizardinfo.py

Google Play 服务（com.google.android.gms）

  • /data/com.google.android.gms/app_semanticlocation_rawsignal_db
    • 绿色回望：Android 的设备端位置历史
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appSemloc.py
  • /data/com.google.android.gms/app_semanticlocation_placeindex_cache
    • 绿色回望：Android 的设备端位置历史
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
  • /data/com.google.android.gms/app_semanticlocation_odlh_cache
    • 绿色回望：Android 的设备端位置历史
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
  • /data/com.google.android.gms/databases/cast.db
    • Android 投屏（设备）故事："cast.db"
      https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googleCast.py
  • /data/com.google.android.gms/databases/constellation.db
    • Hex Diving — 发现隐藏取证痕迹的简便方法
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html

Google Play 商店 (com.android.vending)

  • /data/com.android.vending/databases/data_usage.db
    • Cisco WebEx 桌面客户端、Web 和 Android 智能手机应用的取证调查
      https://link.springer.com/article/10.1007/s12243-022-00919-6
    • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.android.vending/databases/frosting.db
    • Android 系统上应用安装日志的分析
      https://dl.acm.org/doi/10.1145/3297280.3297489
    • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py
  • /data/com.android.vending/databases/install_queue.db
    • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html

Google 快速搜索 (com.google.android.googlequicksearchbox)

  • Android 上的 Google 搜索与个人助理数据
    http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html
  • Google 搜索栏与搜索词历史 – 你找到所有内容了吗？
    https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/
  • Google Assistant 的取证调查
    https://link.springer.com/article/10.1007/s42979-020-00285-x
  • Android 蓝牙连接如何确定事故期间驾驶员的手是否放在方向盘上
    https://dfir.pubpub.org/pub/6ysxvhvc/release/1
  • 协作测试服务 - 移动数字证据 - 2016
    https://cts-forensics.com/reports/36550_Web.pdf
  • DroidForensics：通过多层取证日志准确重建 Android 攻击
    https://kyuhlee.github.io/publications/asiaccs17.pdf
  • 移动取证调查：证据收集、分析和呈现指南 - 第二版
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
    https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
  • Magnet 用户峰会 2023 CTF - Android（第 2 部分）
    https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html
  • aLEAPP 插件
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py

Google 服务框架 (com.google.android.gsf)

  • /data/com.google.android.gsf/databases/gservices.db
    • 协作测试服务 - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gsf/databases/googlesettings.db
    • Android 智能手机无线网络证据的取证分析
      https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf
    • 协作测试服务 - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py

信息 (com.google.android.apps.messaging)

  • /data/com.google.android.apps.messaging/databases/bugle_db
    • Hex Diving — 发现隐藏取证痕迹的简单方法
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Android 消息取证 – SMS/MMS 及其他
      https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet User Summit 2023 CTF - Android（第 1 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • 移动取证调查：证据收集、分析和演示指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMessages.py
  • /data/com.google.android.apps.messaging/shared_prefs/sim_state_tracker.xml
    • Magnet Virtual Summit 2025 CTF - Android/b>
      https://www.stark4n6.com/2025/03/magnet-virtual-summit-2025-ctf-android.html

Samsung One UI Home (com.sec.android.app.launcher)

  • 从取证提取中重建 Android 应用、文件夹和小组件的屏幕位置
    https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html

Android 联系人存储 (com.android.providers.contacts)

  • /data/com.android.providers.contacts/databases/calllog.db
    • Collaborative Testing Services - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Hex Diving — 发现隐藏取证痕迹的简单方法
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Android 7.0 Nougat 上的 Calllog.db 和短信数据
      https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html
    • Android 移动设备痕迹：犯罪调查中的数字证据宝库 
      https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf
下载工具
  • 安卓系统产物：设备信息与使用情况的取证分析
    https://belkasoft.com/android-system-artifacts-device
  • 协作测试服务 - 移动数字证据 - 2015
    https://cts-forensics.com/reports/35550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2016
    https://cts-forensics.com/reports/36550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2017
    https://cts-forensics.com/reports/37550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2019
    https://cts-forensics.com/reports/19-5550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2020
    https://cts-forensics.com/reports/20-5550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2021
    https://cts-forensics.com/reports/21-5550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2022
    https://cts-forensics.com/reports/22-5550_Web.pdf
  • 协作测试服务 - 移动数字证据 - 2024
    https://cts-forensics.com/reports/24-5550_Web.pdf
  • Cellebrite CTF 2021 复盘
    https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
  • 第 1 部分：2021 CTF 答案详解 – 调查海森堡的安卓设备
    https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
  • Cellebrite CTF 2021 - 海森堡的安卓设备
    https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
  • Cellebrite CTF 2022 - 海森堡的安卓设备
    https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html
  • 调查安卓蓝牙
    https://forensafe.com/blogs/Android_Bluetooth.html
  • aLEAPP 插件
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py
  • /misc/bootstat/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py
  • /misc/wifi/qtables.json
  • /misc/wifi/wpa_supplicant.conf
    /misc/wifi/WifiConfigStore.xml
    /misc/apexdata/com.android.wifi/WifiConfigStore.xml
    • 协作测试服务 - 移动数字证据 - 2015
      https://cts-forensics.com/reports/35550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Cellebrite 2020 秋季 CTF - 第 1 部分 - Tony Mederos
      https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html
    • 使用谷歌 Wear OS 打卡
      https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/
    • 学习安卓取证 - 第二版
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • 移动取证调查：证据收集、分析、呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • 剖析安卓 WiFiConfigStore.xml 以进行取证分析
      https://blog.digital-forensics.it/2024/02/dissecting-android-wificonfigstorexml.html
    • 调查安卓 Wi-Fi 信息
      https://forensafe.com/blogs/Android_wifi_Information.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore2.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py
  • /misc/wifi/softap.conf
    /misc/apexdata/com.android.wifi/WifiConfigStoreSoftAp.xml
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py
    • 协作测试服务 - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • 让我们来解题 - Cellebrite 2022 CTF 复盘
      https://www.dfirblog.com/cellebrite-2022-ctf-writeup/
    • Cellebrite CTF 2022 - 海森堡的安卓设备
      https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html
    • 让我们来解题 - Cellebrite 2022 CTF 复盘
      https://www.dfirblog.com/cellebrite-2022-ctf-writeup/
    • 移动取证调查：证据收集、分析、呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • /misc_de/0/apexdata/com.android.permission/runtime-permissions.xml
    • 安卓的“危险”权限
      https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/
    • 安卓 - 角色与权限（Android 10/11）
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • 检查一部感染恶意软件的安卓手机。这部安卓设备不太对劲。
      https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/
    • 初探 Android 14 取证
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 用户是否曾使用过 XYZ 应用？即移动设备上应用执行的痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py
  • /misc_de/0/apexdata/com.android.permission/roles.xml
    • 安卓 - 角色与权限（Android 10/11）
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • 安卓的“危险”权限
      https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/
    • 初探 Android 14 取证
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet 虚拟峰会 2024 CTF - 安卓
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • 2024 Magnet 虚拟峰会 CTF 通关攻略
      https://m-brumbelow.github.io/posts/MVS2024CTF/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py
  • 超级周日欢乐取证挑战 - 更新 4
    https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html
  • 移动取证调查：证据收集、分析与呈现指南 - 第二版
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • /system/shutdown-checkpoints/
    • Android 12 中的关机检查点
      https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py
  • /system/users/0.xml
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • 物联网生态系统的取证分析
      https://hal.archives-ouvertes.fr/hal-03369836/document
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/users/0/app_idle_stats.xml
  • /system/users/0/settings_global.xml
    • 取证调查期间对 Android 设置的分析
      https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
  • /system/users/0/settings_secure.xml
    • Cellebrite CTF 2021 - 海森堡的 Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • 第 1 部分：2021 CTF 答案详解——调查海森堡的 Android 设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • 检查感染恶意软件的 Android 手机。这部 Android 不太对劲。
      https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/
    • 取证调查期间对 Android 设置的分析
      https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
    • Magnet 用户峰会 2023 CTF - Android（第 1 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Android 系统痕迹：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py
  • /system/users/0/settings_ssaid.xml
    • 即时通讯工具的取证分析：解密 Signal、Wickr 和 Threema
      https://www.sciencedirect.com/science/article/pii/S2666281722000166
    • 调查 Android 版 Wickr
      https://forensafe.com/blogs/Android_Wickr.html
  • /system/users/0/settings_system.xml
    • Android - 角色与权限（Android 10/11）
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • 取证调查期间对 Android 设置的分析
      https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/users/service/data/eRR.p
    • DeRR.p：调查三星设备上的电源事件
      https://thebinaryhick.blog/2024/04/07/__trashed/
    • 清除！检测 Android 恢复出厂设置
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • 第 1 部分：2021 CTF 答案详解——调查海森堡的 Android 设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • 手机电池的比较、演进与挑战——Android 小米手机电池在取证研究中的作用
      https://www.jetir.org/papers/JETIR2408628.pdf
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/errp.py
  • /system/appops.xml
    • 窥探 Android 12 的隐私面板
      https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/
    • 清除！检测 Android 恢复出厂设置
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py
    • AI 音箱生态系统的数字取证实践与方法
      https://www.sciencedirect.com/science/article/pii/S1742287619301628
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/batterystats.bin
    • 视频发烧友：我们知道你在看什么
      https://par.nsf.gov/servlets/purl/10215810
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 手机电池的比较、演进与挑战——Android 小米手机电池在取证研究中的作用
      https://www.jetir.org/papers/JETIR2408628.pdf
  • /system/batterystats-checkin.bin
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /system/batterystats-daily.xml
    • 你走的每一步：Android 中的应用和网络使用
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 用户是否曾使用过 XYZ 应用？即移动设备上应用执行的痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
  • /system/deviceidle.xml
  • /system/locksettings.db
    • Android 系统痕迹：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • 新年挑战 CyberTalents CTF 2025|取证 Writeup
      https://medium.com/@SIGMA_001/new-year-challenge-cybertalents-ctf-2025-forensics-writeup-dd5c46e126c4
  • /system/netpolicy.xml
    • Cellebrite CTF 2021 - 海森堡的 Android
      https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html
    • 第 1 部分：2021 CTF 答案详解——调查海森堡的 Android 设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Cellebrite CTF 2021 Writeup
      https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • 协作测试服务 - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
  • /system/notification_policy.xml
    • 第 1 部分：2021 CTF 答案详解——调查海森堡的 Android 设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 通知历史的取证分析
      https://ieeexplore.ieee.org/document/10679344
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py
  • /system/PkgPredictions.db
    • 用户是否曾使用过 XYZ 应用？即移动设备上应用执行的痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/pkgPredictions.py
  • /system/SemWifiApContentProvider
    • 第 2 部分：CTF 2022 Write Up——海森堡的 Android
      https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/
  • /system/SimCard.dat
    • 协作测试服务 - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • 移动取证调查：证据收集、分析与呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • /system/WifiConfigStore.db
  • /system/WifiHistory.db
  • /system/wifigeofence.db
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
  • /system/packages.xml
    • Android - 角色与权限（Android 10/11）
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 用户是否曾使用过 XYZ 应用？即移动设备上应用执行的痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • 移动取证：发现未被发现之物
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • /data/system/ 目录中的一些痕迹
      http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • 移动取证调查：证据收集、分析与呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py
  • /system/packages.list
    • Android - 角色与权限（Android 10/11）
      https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 用户是否曾使用过 XYZ 应用？即移动设备上应用执行的痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • 学习 Android 取证 - 第二版
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • 移动取证调查：证据收集、分析与呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • 学习 Android 取证 - 第二版
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py
  • /system_ce/0/accounts_ce.db
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2023
      https://cts-forensics.com/reports/23-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2024
      https://cts-forensics.com/reports/24-5550_Web.pdf
    • 第 1 部分：2021 CTF 答案详解——调查海森堡的 Android 设备
      https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/
    • Android - 追踪设备迁移
      https://blog.d204n6.com/2021/06/android-tracking-device-migration.html
    • Magnet 用户峰会 2023 CTF - Android（第 1 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Magnet 虚拟峰会 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 调查 Android 账户
      https://forensafe.com/blogs/Android_Accounts.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py
  • /system_ce/notification_history/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 通知历史的取证分析
      https://ieeexplore.ieee.org/document/10679344
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/notificationHistory.py
  • /system_ce/recent_images/
    • 移动取证：发现未被发现之物
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 最近任务 XML 解析器
      https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html
    • 你走的每一步：Android 中的应用和网络使用
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • AI 音箱生态系统的数字取证实践与方法
      https://www.sciencedirect.com/science/article/pii/S1742287619301628
    • 移动取证调查：证据收集、分析与呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py
  • /system_ce/recent_tasks/
    • 移动取证：发现未被发现之物
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Android 最近任务 XML 解析器
      https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • AI 音箱生态系统的数字取证实践与方法
      https://www.sciencedirect.com/science/article/pii/S1742287619301628
    • 佐证。仅此而已。
      https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/
    • 你走的每一步：Android 中的应用和网络使用
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • 移动取证调查：证据收集、分析与呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • Magnet 每周 CTF Writeup
      https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py
  • /system_ce/shortcuts/
  • /system_ce/snapshots/
    • 佐证。仅此而已。
      https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/
    • Android 最近任务 XML 解析器
      https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html
    • 移动取证：发现未被发现之物
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet 虚拟峰会 2022 CTF - Android
      https://www.stark4n6.com/2022/05/magnet-virtual-summit-2022-ctf-android.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py
  • /system_ce/usagestats/
    • Android 使用统计 XML 解析器
      https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html
    • 通过 UsageStats 识别 Android 操作系统版本
      https://www.sans.org/white-papers/40265/
    • Android 10 (Q) 上的使用统计
      http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html
    • 移动取证：发现未被发现之物
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • /data/system/ 目录中的一些痕迹
      http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html
    • Android Dumpsys 分析：识别驾驶员分心
      https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf
    • 你走的每一步：Android 中的应用和网络使用
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • 追踪已删除应用的痕迹
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
    • 没有 build.props 文件判断 Android 版本
      https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Magnet 用户峰会 2023 CTF - Android（第 1 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Android 内部机制
      http://newandroidbook.com/Book/2-Excerpt-Data.pdf
    • 移动取证调查：证据收集、分析与呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py
  • /system_de/0/accounts_de.db
    • Android - 追踪设备迁移
      https://blog.d204n6.com/2021/06/android-tracking-device-migration.html
    • 使用 Google 的 Wear OS 打卡
      https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • 调查 Android 账户
      https://forensafe.com/blogs/Android_Accounts.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Magnet 用户峰会 2023 CTF - Android（第 1 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
    • Magnet 虚拟峰会 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py
    Cellebrite 2023 CTF回顾：Russell的Android设备答案

    https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/
  • Hex Diving — 发现隐藏取证工件的简便方法
    https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
  • Android移动工件：犯罪调查中的数字证据宝库 
    https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf
  • Magnet User Summit 2023 CTF - Android（第1部分）
    https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html
  • Magnet Virtual Summit 2024 CTF - Android
    https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
  • 2024 Magnet Virtual Summit CTF 通关攻略
    https://m-brumbelow.github.io/posts/MVS2024CTF/
  • 移动取证调查：证据收集、分析与呈现指南 - 第二版
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • aLEAPP插件
    https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/siminfo.py
  • /user_de/0/com.android.settings/databases/applist.db
  • /user_de/0/com.samsung.accessibility/shared_prefs/accessibility_prefs.xml
  • /user_de/0/com.sec.imsservice/shared_prefs/capdiscovery_0.xml
  • Collaborative Testing Services - 移动数字证据 - 2017
    https://cts-forensics.com/reports/37550_Web.pdf
  • 针对Google Drive客户端残留数据的移动取证调查分析方法提案
    https://jit.ndhu.edu.tw/article/download/1795/1801
  • 移动取证调查：证据收集、分析与呈现指南 - 第二版
    https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
  • aLEAPP插件
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py
  • Turbo 加速：解析 Google 的设备健康服务
    https://dfir.pubpub.org/pub/4can3p40/release/1
  • aLEAPP 插件
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py
  • /data/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml
    • Turbo 第 3 部分 - 设备健康服务的应用使用情况
      https://www.stark4n6.com/2021/06/turbo-application-usage.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 系统痕迹：设备信息与使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-device
    • Turbo 加速：解析 Google 的设备健康服务
      https://dfir.pubpub.org/pub/4can3p40/release/1
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py
  • /data/com.google.android.settings.intelligence/shared_prefs/suggestions.xml
    • 彻底清除！检测 Android 恢复出厂设置
      https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/suggestions.py
  • /data/com.google.android.gms/databases/gass.db
    • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py
  • /data/com.google.android.gms/databases/gms.notifications.db
  • /data/com.google.android.gms/databases/google_account_history.db
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/google_app_measurement.db
    • Android 应用取证
      https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&sequence=1
    • Android 版 Bumble 交友应用的取证分析
      https://www.mdpi.com/2673-6756/2/1/16/htm
  • /data/com.google.android.gms/databases/herrevad
    • HERREVAD 数据库地理位置痕迹
      http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html
    • 更新 - HERREVAD 数据库地理位置痕迹
      http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html
    • 更新 2 - HERREVAD 数据库地理位置痕迹
      http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html
    • 更新 3 - HERREVAD 数据库地理位置痕迹
      http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html
    • 协作测试服务 - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
  • /data/com.google.android.gms/databases/icing_contacts.db
    • 从屏幕损坏的 Android 手机中恢复数据 - 替代方案
      https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/icing_mmssms.db
    • Cellebrite-icing_mmssms.db-Parser
      https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md
    • Android 消息取证 – SMS/MMS 及其他
      https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/
  • /data/data/com.google.android.gms/databases/MdpSimBasedDatabase
    • Hex Diving — 发现隐藏取证痕迹的简便方法
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/databases/NetworkUsage.db
    • 为线索提供背景：Android 设备位置数据的恢复与可靠性
      https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&httpsredir=1&article=2353&context=etd
  • /data/com.google.android.gms/databases/ns.db
  • /data/com.google.android.gms/databases/reminders.db
    • 智能音箱取证
      https://core.ac.uk/download/pdf/230544843.pdf
  • /data/com.google.android.gms/files/fcm_queued_messages.ldb
    • Android 上的 FCM 排队消息
      https://www.cclsolutionsgroup.com/post/fcm-queued-messages-on-android
    • Android Firebase Cloud Messaging
      https://forensafe.com/blogs/AndroidFCM.html
    • 并非所有流浪的 Android 都会迷失：探析 Android 的查找我的设备网络
      https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/FCMQueuedMessagesDump.py
  • /data/com.google.android.gms/shared_prefs/batterystats.xml
    • 你迈出的每一步：Android 中的应用和网络使用情况
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
  • /data/com.google.android.gms/shared_prefs/adid_settings.xml
  • /data/com.google.android.gms/shared_prefs/BackupAccount.xml
    • 调查 Android 账户
      https://forensafe.com/blogs/Android_Accounts.html
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
  • /data/com.google.android.gms/shared_prefs/Checkin.xml
    • 协作测试服务 - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Hex Diving — 发现隐藏取证痕迹的简便方法
      https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/
    • Cellebrite CTF 2021 Writeup
      https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
    • Cellebrite CTF 2022 - 海森堡的 Android
      https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html
    • 调查 Android 最后使用的 SIM 卡
      https://forensafe.com/blogs/Android_Last_SIM.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • /data/com.google.android.gms/shared_prefs/nearbysharing:service:state.xml
    • Nearby Share – Android 版 AirDrop（不请自来的 Richard 照片回归）
      https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/
  • /data/com.google.android.gms/shared_prefs/ULR_USER_PREFS.xml
    • 绿色回望：Android 的设备端位置历史
      https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/ulrUserprefs.py
  • 应用何时不再是应用？探究 Android 上的 WebAPK
    https://www.cclsolutionsgroup.com/post/when-is-an-app-not-an-app-investigating-webapks-on-android
  • Cisco WebEx 桌面客户端、Web 和 Android 智能手机应用的取证调查
    https://link.springer.com/article/10.1007/s12243-022-00919-6
  • /data/com.android.vending/databases/library.db
    • 移动取证：发现未发现之物
      https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/
    • Android 系统上应用安装日志的分析
      https://dl.acm.org/doi/10.1145/3297280.3297489
    • CTF Cellebrite CTF 2020：Rene Gade
      https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/
    • 追踪已删除应用的痕迹
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
    • 你走的每一步：Android 中的应用和网络使用情况
      https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html
    • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 如何揭示移动设备调查中的应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py
  • /data/com.android.vending/databases/localappstate.db
    • Android 系统上应用安装日志的分析
      https://dl.acm.org/doi/10.1145/3297280.3297489
    • 追踪已删除应用的痕迹
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
    • 第 2 部分：CTF 2022 解题报告 – Heisenberg 的 Android
      https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/
    • 协作测试服务 - 移动数字证据 - 2015
      https://cts-forensics.com/reports/35550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • 用户是否曾使用过 XYZ 应用？即移动设备上的应用执行痕迹
      https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 调查 Android 已安装应用
      https://forensafe.com/blogs/Android_InstalledApps.html
    • 移动取证调查：证据收集、分析和呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py
  • /data/com.android.vending/databases/package_verification.db
    • 追踪已删除应用的痕迹
      https://www.youtube.com/watch?v=4LcQm4ErXpA
      https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html
  • /data/com.android.vending/databases/suggestions.db
    • 协作测试服务 - 移动数字证据 - 2015
      https://cts-forensics.com/reports/35550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • 协作测试服务 - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • Android 系统痕迹：应用使用情况的取证分析
      https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage
    • Magnet 用户峰会 2023 CTF - Android（第 2 部分）
      https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html
    • Magnet 虚拟峰会 2024 CTF - Android
      https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html
    • 调查 Android Play Store 搜索历史
      https://forensafe.com/blogs/Android_PlayStoreSearch.html
    • 移动取证调查：证据收集、分析和呈现指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googlePlaySearches.py
  • /data/com.android.vending/databases/verify_apps.db
    • Cisco WebEx 桌面客户端、Web 和 Android 智能手机应用的取证调查
      https://link.springer.com/article/10.1007/s12243-022-00919-6
  • 通话记录查询
    https://github.com/kacos2000/Queries/blob/master/calllog_db.sql
  • Android 14 取证初探
    https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
  • 调查 Android 通话记录
    https://forensafe.com/blogs/Android_Call_logs.html
  • 调查 Android 短信
    https://forensafe.com/blogs/AndroidSMS.html
  • 如何在移动设备调查中发现应用痕迹
    https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
  • Road Trippin’ – 探索三星手机上的蓝牙通话路由
    https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/
  • 学习 Android 取证 - 第二版
    https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
  • 实用移动取证 - 第四版
    https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • aLEAPP 插件
    https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py
  • /data/com.android.providers.contacts/databases/contacts2.db
    • 开源移动设备取证
      https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf
    • Collaborative Testing Services - 移动数字证据 - 2016
      https://cts-forensics.com/reports/36550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2017
      https://cts-forensics.com/reports/37550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2018
      https://cts-forensics.com/reports/38550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2019
      https://cts-forensics.com/reports/19-5550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2020
      https://cts-forensics.com/reports/20-5550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf
    • Collaborative Testing Services - 移动数字证据 - 2022
      https://cts-forensics.com/reports/22-5550_Web.pdf
    • Android 移动设备痕迹：犯罪调查中的数字证据宝库 
      https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf
    • 联系人查询
      https://github.com/kacos2000/Queries/blob/master/contacts2.sql
    • 联系人来电查询
      https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql
    • 学习 Android 取证 - 第二版
      https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017
    • Android 14 取证初探
      https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html
    • 调查 Android 联系人
      https://forensafe.com/blogs/Android_Contacts.html
    • 如何在移动设备调查中发现应用痕迹
      https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/
    • 实用移动取证 - 第四版
      https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • 移动取证调查：证据收集、分析和演示指南 - 第二版
      https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/
    • aLEAPP 插件
      https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py
  • /data/com.android.providers.contacts/files/photos/
    • Collaborative Testing Services - 移动数字证据 - 2021
      https://cts-forensics.com/reports/21-5550_Web.pdf

    Android 消息存储 (com.android.providers.telephony)

    • /data/user_de/0/com.android.providers.telephony/databases/mmssms.db
      /data/com.android.providers.telephony/databases/mmssms.db
      • Android 消息取证 – SMS/MMS 及其他
        https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/
      • Android mmssms.db 各数据表介绍
        https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2

        • 阅读更多