Practical Mobile Forensics - Third Edition

Analysis of social networking/IM chats

Social networking and IM chat applications such as Facebook, Twitter, and WhatsApp reveal sensitive data, which could be helpful during the investigation of any case. The analysis is pretty much the same as with any other Android applications. Download the data to a forensic workstation and analyze the .db files to find out if you can unearth any sensitive information. For example, let's look at the Facebook application and try to see what data can be extracted. First, we extract the /data/data/com.facebook.katana folder and navigate to the databases folder. The fb.db file present under this folder contains the information that is associated to the user's account. The friends_data table contains information ...