Practical Mobile Forensics - Third Edition

Facebook Android app analysis

The Facebook Android app is one of the most widely used social networking applications. It stores the information under the /data/data folder, with the com.facebook.katana package name. The following details provide an overview of the kind of information that can be gathered across various files:

• Facebook contacts: Information about the user's Facebook contacts can be retrieved by analyzing the contacts_db2 database, which is present under the following path:
  • Path: /data/data/com.facebook.katana/databases/contacts_db2
  • The contacts_db2 database (SQLite file) contains a table named contacts, which has most of the information, such as their first names, last names, display names, and URL for display picture.