Get full access to Learning Android Forensics - Second Edition and 60K+ other titles, with a free 10-day trial of O'Reilly.

There are also live events, courses curated by job role, and more.

Start your free trial

Facebook Messenger analysis

Facebook Messenger is messaging app, separate from the main Facebook application. It has over 500,000,000 downloads in the Play Store.

Package name: com.facebook.orca

Files of interest:

/cache/
- audio/
- fb_temp/
- image/
/sdcard/com.facebook.orca
/files/ rti.mqtt.analytics.xml
/databases/
- call_log.sqlite
- contacts_db2
- prefs_db
- threads_db2

The /cache/audio directory contains audio messages sent through the application. The files have a .cnt file extension, but are actually RIFF files that can be played with Windows Media Player, VLC media player, and other programs.

The /cache/fb_temp path contains temp files for images and video sent through the application. It is unclear how long these files will remain; in ...

Get Learning Android Forensics - Second Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Don’t leave empty-handed

Get Mark Richards’s Software Architecture Patterns ebook to better understand how to design components—and how they should interact.

It’s yours, free.

Get it now

Check it out now on O’Reilly

Dive in for free with a 10-day trial of the O’Reilly learning platform—then explore all the other resources our members count on to build skills and solve problems every day.

Start your free trial Become a member now