Practical Mobile Forensics - Third Edition

Android applications

Android devices rely heavily on SQLite for application storage. The preference files for each application are often in the DAT or XML file formats. More so than an iOS device, examining applications on an Android may be one of the most tedious tasks. This is due to the various locations that data may be stored in. The best place to start is with a tool that will provide a listing of what is installed on the device. Next, go to the subdirectories off the /Root directory. Remember, these applications may possess unique names and may be difficult to locate.

You may have to research the application to gain a better understanding of the filenames that are associated with each of them. The following screenshot is an example ...