Practical Mobile Forensics - Fourth Edition

Gmail Android app analysis

Gmail is a widely used email service offered by Google. The application data is saved under the /data/data folder, with the package name com.google.android.gm. The following are the important artifacts that can be extracted by analyzing the Gmail app:

• Account details: The XML files present under /shared_prefs confirm the email account details. Details of other accounts, which are linked to the current email, can be identified from the Gmail.xml file:
  • Path: /data/data/com.google.android.gm/cache/<username>@gmail.com
• Attachments: Attachments that are recently used in both sending and receiving emails are saved to the /cache directory. This is valuable because it gives us access to items that have been deleted ...