Practical Mobile Forensics - Fourth Edition

Analysis of social networking/IM chats

Social networking and IM chat applications such as Facebook, Twitter, and WhatsApp reveal sensitive data that could be helpful during the investigation of any case. The analysis is pretty much the same as with any other Android application. Download the data to a forensic workstation and analyze the .db files to find out whether you can unearth any sensitive information. For example, let's look at the Facebook application and try to see what data can be extracted.

First, we extract the /data/data/com.facebook.katana folder and navigate to the databases folder. The fb.db file present under this folder contains the information that is associated with the user's account. The friends_data table contains ...