Practical Mobile Forensics - Third Edition

Reverse engineering Android apps

The examiner may need to deal with applications that stand as a barrier to accessing the required information. For instance, take the case of the gallery on a phone that is locked by an AppLock application. In this case, in order to access the pictures and videos stored in the gallery, you first need to enter the passcode to the AppLock. Hence, it would be interesting to know how the AppLock app stores the password on the device. You might look into the SQLite database files. However, if they are encrypted, then it's hard to even tell that it's a password. Reverse engineering applications would be helpful in such cases where you want to better understand the application and how the application stores the data. ...