└── README.md
/README.md:
--------------------------------------------------------------------------------
1 | # Android Forensics References
2 |
Last update: September 22th 2025
3 |
4 |
USERDATA Partition
5 |
6 |
7 |
"/log" folder
8 |
9 |
10 |
11 |
12 | - /log/wifi/iwc/iwc_dump.txt
13 |
16 | - /log/netstats
17 | - /log/batterystats
18 |
23 | - /log/recovery
24 | - /log/sdp_log
25 |
28 | - /log/thermal_log
29 | - /log/power_off_reset_reason.txt
30 |
38 |
39 |
40 |
41 |
42 |
"/misc" and "/misc_de" folder
43 |
44 |
45 |
46 |
47 | - /misc/adb/adb_keys
48 |
52 | - /misc/bluedroiddump/mainBuffer.log
53 |
57 | - /misc/bluedroiddump/subBuffer.log
58 |
61 | - /misc/bluedroid/bt_config.conf
62 |
83 | - /misc/bootstat/
84 |
87 | - /misc/wifi/qtables.json
88 | - /misc/wifi/wpa_supplicant.conf
/misc/wifi/WifiConfigStore.xml
/misc/apexdata/com.android.wifi/WifiConfigStore.xml
89 |
105 | - /misc/wifi/softap.conf
/misc/apexdata/com.android.wifi/WifiConfigStoreSoftAp.xml
106 |
114 | - /misc_de/0/apexdata/com.android.permission/runtime-permissions.xml
115 |
123 | - /misc_de/0/apexdata/com.android.permission/roles.xml
124 |
132 |
133 |
134 |
135 |
136 |
"/property" folder
137 |
138 |
139 |
140 |
141 | - /property/persistent_properties
142 |
146 |
147 |
148 |
149 |
150 |
151 |
"/system", "/system_ce" and "/system_de" folders
152 |
153 |
154 |
155 |
156 | - /system/appops/
157 |
163 | - /system/batteryusagestats/
164 | - /system/job/jobs.xml
165 | - /system/netstats/
166 |
171 | - /system/procstats/
172 |
175 | - /system/sync/accounts.xml
176 |
182 | - /system/shutdown-checkpoints/
183 |
188 | - /system/users/0.xml
189 |
195 | - /system/users/0/app_idle_stats.xml
196 | - /system/users/0/settings_global.xml
197 |
200 | - /system/users/0/settings_secure.xml
201 |
211 | - /system/users/0/settings_ssaid.xml
212 |
216 | - /system/users/0/settings_system.xml
217 |
222 | - /system/users/service/data/eRR.p
223 |
230 | - /system/appops.xml
231 |
239 | - /system/batterystats.bin
240 |
246 | - /system/batterystats-checkin.bin
247 |
250 | - /system/batterystats-daily.xml
251 |
256 | - /system/deviceidle.xml
257 | - /system/locksettings.db
258 |
262 | - /system/netpolicy.xml
263 |
270 | - /system/notification_policy.xml
271 |
277 | - /system/PkgPredictions.db
278 |
282 | - /system/SemWifiApContentProvider
283 |
286 | - /system/SimCard.dat
287 |
294 | - /system/WifiConfigStore.db
295 | - /system/WifiHistory.db
296 | - /system/wifigeofence.db
297 |
300 | - /system/packages.xml
301 |
313 | - /system/packages.list
314 |
325 | - /system_ce/0/accounts_ce.db
326 |
339 | - /system_ce/notification_history/
340 |
345 | - /system_ce/recent_images/
346 |
356 | - /system_ce/recent_tasks/
357 |
369 | - /system_ce/shortcuts/
370 | - /system_ce/snapshots/
371 |
380 | - /system_ce/usagestats/
381 |
399 | - /system_de/0/accounts_de.db
400 |
410 |
411 |
412 |
413 |
414 |
"/user_de" folder
415 |
416 |
417 |
418 |
419 | - /user_de/0/com.android.bluetooth/bonddevice.db
420 |
424 | - /user_de/0/com.android.providers.telephony/databases/telephony.db
425 |
443 | - /user_de/0/com.android.settings/databases/applist.db
444 | - /user_de/0/com.samsung.accessibility/shared_prefs/accessibility_prefs.xml
445 | - /user_de/0/com.sec.imsservice/shared_prefs/capdiscovery_0.xml
446 |
447 |
448 |
449 |
450 |
"/data" folder
451 |
452 |
453 |
454 |
Google Digital Wellbeing (com.google.android.apps.wellbeing)
455 |
456 |
457 |
458 |
459 | - /data/com.google.android.apps.wellbeing/databases/app_usage
460 |
470 |
471 |
472 |
473 |
474 |
Samsung Digital Wellbeing (com.samsung.forest)
475 |
476 |
477 |
478 |
479 | - /data/com.samsung.forest/databases/dwbCommon.db
480 |
489 |
490 |
491 |
492 |
493 |
Google Docs (com.google.android.apps.docs)
494 |
495 |
496 |
497 |
498 | - /data/com.google.android.apps.docs/databases/cello.db
499 |
505 | - /data/com.google.android.apps.docs/databases/DocList.db
506 |
519 |
520 |
521 |
522 |
523 |
Files by Google (com.google.android.apps.nbu.files)
524 |
525 |
526 |
527 |
528 | - /data/com.google.android.apps.nbu.files/databases/files_master_database
529 | - /data/com.google.android.apps.nbu.files/databases/search_history_database
533 | - /data/com.google.android.apps.nbu.files/databases/search_history_database
534 | - /data/com.google.android.apps.nbu.files/databases/search_history_database
538 |
539 |
540 |
541 |
542 |
Device Health Services (com.google.android.apps.turbo)
543 |
544 |
545 |
546 |
547 | - /data/com.google.android.apps.turbo/databases/turbo.db
548 |
558 | - /data/com.google.android.apps.turbo/databases/bluetooth.db
559 |
566 | - /data/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml
567 |
574 |
575 |
576 |
577 |
578 |
Device Personalization Services (DPS) (com.google.android.as)
579 |
580 |
581 |
582 |
583 | - /data/com.google.android.as/databases/reflection_gel_events.db
584 |
589 | - /data/com.google.android.as/databases/SimpleStorage
590 |
595 |
596 |
597 |
598 |
599 |
Settings Services (com.google.android.settings.intelligence)
600 |
601 |
602 |
603 |
604 | - /data/com.google.android.settings.intelligence/databases/battery-usage-db-v4
605 |
612 |
613 |
614 | - /data/com.google.android.settings.intelligence/databases/battery-usage-db-v9
615 |
619 | - /data/com.google.android.settings.intelligence/shared_prefs/setup_wizard_info.xml
620 |
625 | - /data/com.google.android.settings.intelligence/shared_prefs/suggestions.xml
626 |
631 |
632 |
633 |
634 |
635 |
Google Play Service (com.google.android.gms)
636 |
637 |
638 |
639 |
640 | - /data/com.google.android.gms/app_semanticlocation_rawsignal_db
641 |
645 | - /data/com.google.android.gms/app_semanticlocation_placeindex_cache
646 |
649 | - /data/com.google.android.gms/app_semanticlocation_odlh_cache
650 |
653 | - /data/com.google.android.gms/databases/cast.db
654 |
659 | - /data/com.google.android.gms/databases/constellation.db
660 |
664 | - /data/com.google.android.gms/databases/gass.db
665 |
671 | - /data/com.google.android.gms/databases/gms.notifications.db
672 | - /data/com.google.android.gms/databases/google_account_history.db
673 |
676 | - /data/com.google.android.gms/databases/google_app_measurement.db
677 |
681 | - /data/com.google.android.gms/databases/herrevad
682 |
689 | - /data/com.google.android.gms/databases/icing_contacts.db
690 |
694 | - /data/com.google.android.gms/databases/icing_mmssms.db
695 |
699 | - /data/data/com.google.android.gms/databases/MdpSimBasedDatabase
700 |
704 | - /data/com.google.android.gms/databases/NetworkUsage.db
705 |
708 | - /data/com.google.android.gms/databases/ns.db
709 | - /data/com.google.android.gms/databases/reminders.db
710 |
713 | - /data/com.google.android.gms/files/fcm_queued_messages.ldb
714 |
721 | - /data/com.google.android.gms/shared_prefs/batterystats.xml
722 |
726 | - /data/com.google.android.gms/shared_prefs/adid_settings.xml
727 | - /data/com.google.android.gms/shared_prefs/BackupAccount.xml
728 |
733 | - /data/com.google.android.gms/shared_prefs/Checkin.xml
734 |
745 | - /data/com.google.android.gms/shared_prefs/nearbysharing:service:state.xml
746 |
749 | - /data/com.google.android.gms/shared_prefs/ULR_USER_PREFS.xml
750 |
754 |
755 |
756 |
757 |
758 |
Google Play Store (com.android.vending)
759 |
760 |
761 |
762 |
763 | - /data/com.android.vending/databases/data_usage.db
764 |
769 | - /data/com.android.vending/databases/frosting.db
770 |
777 | - /data/com.android.vending/databases/install_queue.db
778 |
784 | - /data/com.android.vending/databases/library.db
785 |
796 | - /data/com.android.vending/databases/localappstate.db
797 |
815 | - /data/com.android.vending/databases/package_verification.db
816 |
819 | - /data/com.android.vending/databases/suggestions.db
820 |
835 | - /data/com.android.vending/databases/verify_apps.db
836 |
839 |
840 |
841 |
842 |
843 |
Google Quick Search (com.google.android.googlequicksearchbox)
844 |
845 |
846 |
860 |
861 |
862 |
Google Services Framework (com.google.android.gsf)
863 |
864 |
865 |
866 |
867 | - /data/com.google.android.gsf/databases/gservices.db
868 |
872 | - /data/com.google.android.gsf/databases/googlesettings.db
873 |
879 |
880 |
881 |
882 |
883 |
Messages (com.google.android.apps.messaging)
884 |
885 |
886 |
887 |
888 | - /data/com.google.android.apps.messaging/databases/bugle_db
889 |
897 | - /data/com.google.android.apps.messaging/shared_prefs/sim_state_tracker.xml
898 |
901 |
902 |
903 |
904 |
905 |
Samsung One UI Home (com.sec.android.app.launcher)
906 |
907 |
908 |
913 |
914 |
915 |
Android Contacts Storage (com.android.providers.contacts)
916 |
917 |
918 |
919 |
920 | - /data/com.android.providers.contacts/databases/calllog.db
921 |
938 | - /data/com.android.providers.contacts/databases/contacts2.db
939 |
959 | - /data/com.android.providers.contacts/files/photos/
960 |
963 |
964 |
965 |
966 |
967 |
Android Messaging Storage (com.android.providers.telephony)
968 |
969 |
970 |
971 |
972 | - /data/user_de/0/com.android.providers.telephony/databases/mmssms.db
/data/com.android.providers.telephony/databases/mmssms.db
973 |
988 | - /data/com.android.providers.telephony/databases/app_parts/
989 |
992 |
993 |
994 |
995 |
996 |
Android Calendar Storage (com.android.providers.calendar)
997 |
998 |
999 |
1000 |
1001 | - /data/com.android.providers.calendar/databases/calendar.db
1002 |
1014 | - /data/data/com.google.android.calendar/databases/cal_v2a
1015 |
1020 |
1021 |
1022 |
1023 |
1024 |
Android Download Provider (com.android.providers.downloads)
1025 |
1026 |
1027 |
1028 |
1029 | - /data/com.android.providers.downloads/databases/downloads.db
1030 |
1038 |
1039 |
1040 |
1041 |
1042 |
Android Media Storage
1043 |
1044 |
1045 |
1046 |
1047 | - /data/com.google.android.providers.media.module/databases/external.db
1048 |
1058 |
1059 |
1060 |
1061 |
1062 |
Android Logs Provider (com.sec.android.provider.logsprovider)
1063 |
1064 |
1065 |
1066 |
1067 | - /data/com.sec.android.provider.logsprovider/databases/logs.db
1068 |
1075 |
1076 |
1077 |
1078 |
1079 |
Android Location (com.google.android.location)
1080 |
1081 |
1082 |
1083 |
1084 | - /data/com.google.android.location/files/cache.cell/cache.wifi
/data/com.google.android.location/files/cache.cell/cache.cell
1085 |
1089 |
1090 |
1091 |
1092 |
1093 |
Android Auto (com.google.android.projection.gearhead)
1094 |
1095 |
1096 |
1097 |
1098 | - /data/com.google.android.projection.gearhead/databases/carservicedata.db
1099 |
1104 |
1105 |
1106 |
1107 |
1108 |
GBoard Google Keyboard (com.google.android.inputmethod.latin)
1109 |
1110 |
1111 |
1112 |
1113 | - /data/com.google.android.inputmethod.latin/databases/trainingcache*.db
1114 |
1120 |
1121 |
1122 | - /data/com.google.android.inputmethod.latin/databases/gboard_clipboard.db
1123 |
1128 | - /data/com.google.android.inputmethod.latin/files/clipboard_image/
1129 |
1133 |
1134 |
1135 |
1136 |
1137 |
Google Meet (com.google.android.apps.tachyon)
1138 |
1139 |
1140 |
1141 |
1142 | - /data/com.google.android.apps.tachyon/databases/tachyon.db
1143 |
1149 |
1150 |
1151 |
1152 |
1153 |
Google Keep - Notes and lists (com.google.android.apps.tachyon)
1154 |
1155 |
1156 |
1157 |
1158 | - /data/com.google.android.keep/databases/keep.db
1159 |
1170 |
1171 |
1172 |
1173 |
1174 |
Google Tasks (com.google.android.apps.tasks)
1175 |
1176 |
1177 |
1178 |
1179 | - /data/com.google.android.apps.tasks/files/tasks-*/data.db
1180 |
1184 |
1185 |
1186 |
1187 |
1188 |
Google Maps (com.google.android.apps.maps)
1189 |
1190 |
1191 |
1192 |
1193 | - /data/com.google.android.apps.maps/app_tts-cache/
1194 |
1199 | - /data/com.google.android.apps.maps/app_tts-temp/
1200 |
1204 | - /data/com.google.android.apps.maps/databases/gmm_myplaces.db
1205 |
1212 | - /data/com.google.android.apps.maps/databases/gmm_storage.db
1213 |
1219 | - /data/com.google.android.apps.maps/databases/gmm_sync.db
1220 |
1225 | - /data/com.google.android.apps.maps/files/new_recent_history_cache_search.cs
1226 |
1231 | - /data/com.google.android.apps.maps/files/saved_directions.data.cs
1232 |
1237 |
1238 |
1239 |
1240 |
1241 |
Google Photos (com.google.android.apps.photos)
1242 |
1243 |
1244 |
1245 |
1246 | - /data/com.google.android.apps.photos/databases/gphotos*.db*
1247 |
1252 | - /data/com.google.android.apps.photos/databases/disk_cache*
1253 |
1257 | - /com.google.android.apps.photos/databases/local_trash.db
1258 |
1262 |
1263 |
1264 |
1265 |
1266 |
Samsung My Files (com.sec.android.app.myfiles)
1267 |
1268 |
1269 |
1270 |
1271 | - /data/com.sec.android.app.myfiles/databases/myfiles.db
1272 |
1276 | - /data/com.sec.android.app.myfiles/databases/FileInfo.db
1277 |
1280 | - /data/com.sec.android.app.myfiles/databases/FileCache.db
1281 |
1286 |
1287 |
1288 |
1289 |
1290 |
Samsung Gallery (com.sec.android.gallery3d)
1291 |
1292 |
1293 |
1294 |
1295 | - /data/com.sec.android.gallery3d/databases/local.db
1296 |
1300 |
1301 |
1302 |
1303 |
--------------------------------------------------------------------------------