Practical Mobile Forensics - Fourth Edition

Facebook Android app analysis

The Facebook Android app is one of the most widely used social networking applications. It stores its information in the /data/data folder, within the com.facebook.katana package. The following details provide an overview of the kind of information that can be gathered across various files:

• Facebook contacts: Information about the user's Facebook contacts can be retrieved by analyzing the contacts_db2 database, which is present under the following path:
  • Path: /data/data/com.facebook.katana/databases/contacts_db2.
  • The contacts_db2 database (SQLite file) contains a table named contacts, which contains most of the user's information, such as their first name, last name, display name, and URL for display picture. ...