└── README.md


/README.md:
--------------------------------------------------------------------------------
   1 | # Android Forensics References
   2 | <p>Last update: September 22th 2025</p>
   3 | <p>
   4 | <h1>USERDATA Partition</p></h1>
   5 | 
   6 | <p>
   7 | <h2 style="text-align: left;"><b><span style="font-size: medium;">"/log" folder</span></b></h2>
   8 | </p>
   9 | 
  10 | <div>
  11 | 	<ul>
  12 | 		<li><b>/log/wifi/iwc/iwc_dump.txt</b></li>
  13 | 			<ul>
  14 | 				<li><b>Cellebrite CTF 2023 Recap: Answers on Sharon’s Android</b><br /><a href="https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/">https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/</a></li>
  15 | 			</ul>      
  16 | 		<li><b>/log/netstats</b></li>
  17 | 		<li><b>/log/batterystats</b></li>
  18 | 			<ul>
  19 | 				<li><b>Cellebrite CTF 2021 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li>
  20 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a><br /></li>
  21 | 				<li><b>Artefacts of Android device power off due to depleted battery</b><br /><a href="https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery">https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery</a></li>
  22 | 			</ul>
  23 | 		<li><b>/log/recovery</b></li>
  24 | 		<li><b>/log/sdp_log</b></li>
  25 | 			<ul>
  26 | 				<li><b>8 Log files you can collect from iOS and Android devices</b><br /><a href="https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/">https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/</a></li>
  27 | 			</ul>
  28 | 		<li><b>/log/thermal_log</b></li>
  29 | 		<li><b>/log/power_off_reset_reason.txt</b></li>
  30 | 			<ul>
  31 | 				<li><b>DeRR.p. Investigating Power Events on Samsung Devices</b><br /><a href="https://thebinaryhick.blog/2024/04/07/__trashed/">https://thebinaryhick.blog/2024/04/07/__trashed/</a></li>         
  32 | 				<li><b>Samsung Power Off Reset Logs</b><br /><a href="https://www.stark4n6.com/2021/10/samsung-power-off-reset-logs.html">https://www.stark4n6.com/2021/10/samsung-power-off-reset-logs.html</a></li>         
  33 | 				<li><b>8 Log files you can collect from iOS and Android devices</b><br /><a href="https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/">https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/</a></li>         
  34 | 				<li><b>Cellebrite CTF 2021 - Heisenberg's Android<br /></b><a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li>
  35 | 				<li><b>Artefacts of Android device power off due to depleted battery<br /></b><a href="https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery">https://instatronic.com/artefacts-of-android-device-power-off-due-to-depleted-battery</a></li>
  36 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/powerOffReset.py</a></li>
  37 | 			</ul>
  38 | 	</ul>
  39 | </div>
  40 | 
  41 | <p>
  42 | <h2 style="text-align: left;"><b><span style="font-size: medium;">"/misc" and "/misc_de" folder</span></b></h2>
  43 | </p>
  44 | 
  45 | <div>
  46 | 	<ul>
  47 | 		<li><b>/misc/adb/adb_keys</b></li>
  48 | 			<ul>
  49 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
  50 | 				<li><b>aLEAPP plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/adb_hosts.py</a></li>
  51 | 			</ul>
  52 | 		<li><b>/misc/bluedroiddump/mainBuffer.log</b></li>
  53 | 			<ul>
  54 | 				<li><b>Investigating Evidence of Mobile Phone Usage by Drivers in Road Traffic Accidents</b><br /><a href="https://dfrws.org/sites/default/files/session-files/2015_EU_paper-investigating_evidence_of_mobile_phone_usage_by_drivers_in_road_traffic_accidents.pdf">https://dfrws.org/sites/default/files/session-files/2015_EU_paper-investigating_evidence_of_mobile_phone_usage_by_drivers_in_road_traffic_accidents.pdf</a>
  55 | 				<li><b>Forensic Analysis of Wireless Networking Evidence of Android Smartphones</b><br /><a href="https://andriotisp.github.io/assets/pdf/wifs12andrio.pdf">https://andriotisp.github.io/assets/pdf/wifs12andrio.pdf</a>               
  56 | 			</ul>           
  57 | 		<li><b>/misc/bluedroiddump/subBuffer.log</b></li>
  58 | 			<ul>
  59 | 				<li><b>Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones</b><br /><a   href="https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/">https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/</a>
  60 | 			</ul>      
  61 | 		<li><b>/misc/bluedroid/bt_config.conf</b></li>
  62 | 			<ul>
  63 | 				<li><b>How Android Bluetooth Connections Can Determine If The Hands of a Driver Were On The Wheel During An Accident</b><br /><a href="https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/">https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/</a><br /><a href="https://dfir.pubpub.org/pub/6ysxvhvc/release/1">https://dfir.pubpub.org/pub/6ysxvhvc/release/1</a></li>
  64 | 				<li><b>Android Bluetooth Connection Configuration</b><br /><a href="https://www.stark4n6.com/2021/06/android-bluetooth-connection.html">https://www.stark4n6.com/2021/06/android-bluetooth-connection.html</a></li>
  65 | 				<li><b>Android Bluetooth</b><br /><a href="http://forensafe.com/blogs/Android_Bluetooth.html">http://forensafe.com/blogs/Android_Bluetooth.html</a></li>		 
  66 | 				<li><b>Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network</b><br /><a href="https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/">https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/</a></li>
  67 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
  68 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2015</b><br /><a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li>
  69 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
  70 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
  71 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
  72 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
  73 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
  74 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
  75 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
  76 | 				<li><b>Cellebrite CTF 2021 Writeup</b><br /><a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a><br /></li>
  77 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a><br /></li>		 
  78 | 				<li><b>Cellebrite CTF 2021 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li>
  79 | 				<li><b>Cellebrite CTF 2022 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li>
  80 | 				<li><b>Investigating Android Bluetooth</b><br /><a href="https://forensafe.com/blogs/Android_Bluetooth.html">https://forensafe.com/blogs/Android_Bluetooth.html</a>
  81 | 				<li><b>aLEAPP plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/bluetoothConnections.py</a></li>
  82 | 			</ul>
  83 | 		<li><b>/misc/bootstat/</b></li>
  84 | 			<ul>
  85 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/last_boot_time.py</a><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/factory_reset.py</a></li>
  86 | 			</ul>
  87 | 		<li><b>/misc/wifi/qtables.json</b></li>
  88 | 		<li><b><b>/misc/wifi/wpa_supplicant.conf</b><br /></b><b>/misc/wifi/</b><b>WifiConfigStore.xml<br /></b><b>/misc/apexdata/com.android.wifi/WifiConfigStore.xml</b></li>
  89 | 			<ul>
  90 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2015</b><br /><a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li>
  91 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
  92 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
  93 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
  94 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
  95 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
  96 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
  97 | 				<li><b>Cellebrite Fall 2020 CTF - Part 1 - Tony Mederos</b><br /><a href="https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html">https://starwarsfan2099.github.io/2020/11/02/cellebirte-ctf-tony.html</a></li>
  98 | 				<li><b>Clockin’ In with Google’s Wear OS</b><br /><a href="https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/">https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/</a><br /></li>
  99 | 				<li><b>Learning Android Forensics - Second Edition</b><br /><a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li>
 100 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 101 | 				<li><b>Dissecting the Android WiFiConfigStore.xml for forensic analysis</b><br /><a href="https://blog.digital-forensics.it/2024/02/dissecting-android-wificonfigstorexml.html">https://blog.digital-forensics.it/2024/02/dissecting-android-wificonfigstorexml.html</a></li>
 102 | 				<li><b>Investigating Android Wi-Fi Information<br /></b><a href="https://forensafe.com/blogs/Android_wifi_Information.html">https://forensafe.com/blogs/Android_wifi_Information.html</a></li>				
 103 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore2.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiConfigstore2.py</a><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiProfiles.py</a></li>
 104 | 			</ul>
 105 | 		<li><b>/misc/wifi/softap.conf<br /></b><b>/misc/apexdata/com.android.wifi/WifiConfigStoreSoftAp.xml</b></li>
 106 | 			<ul>
 107 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/wifiHotspot.py</a></li>
 108 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 109 | 				<li><b>Let's solve challenges - Cellebrite 2022 CTF Writeup</b><br /><a href="https://www.dfirblog.com/cellebrite-2022-ctf-writeup/">https://www.dfirblog.com/cellebrite-2022-ctf-writeup/</a></li>
 110 | 				<li><b>Cellebrite CTF 2022 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li>
 111 | 				<li><b>Let's solve challenges - Cellebrite 2022 CTF Writeup</b><br /><a href="https://www.dfirblog.com/cellebrite-2022-ctf-writeup/">https://www.dfirblog.com/cellebrite-2022-ctf-writeup/</a></li>
 112 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 113 | 			</ul>
 114 | 		<li><b>/misc_de/0/apexdata/com.android.permission/runtime-permissions.xml</b></li>
 115 | 			<ul>
 116 | 				<li><b>Android’s “Dangerous” Permissions</b><br /><a href="https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/">https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/</a></li>
 117 | 				<li><b>Android - Roles and Permissions (Android 10/11)</b><br /><a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li>
 118 | 				<li><b>Examining A Malware-Infected Android Phone. This Android Is Not Alright.</b><br /><a href="https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/">https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/</a></li>
 119 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 120 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 121 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/runtimePerms.py</a></li>
 122 | 			</ul>
 123 | 		<li><b>/misc_de/0/apexdata/com.android.permission/roles.xml</b></li>
 124 | 			<ul>
 125 | 				<li><b>Android - Roles and Permissions (Android 10/11)</b><br /><a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li>
 126 | 				<li><b>Android’s “Dangerous” Permissions</b><br /><a href="https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/">https://thebinaryhick.blog/2021/01/26/androids-dangerous-permissions/</a></li>
 127 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 128 | 				<li><b>Magnet Virtual Summit 2024 CTF - Android</b><br /><a href="https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html">https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html</a></li>
 129 | 				<li><b>2024 Magnet Virtual Summit CTF Walkthrough</b><br /><a href="https://m-brumbelow.github.io/posts/MVS2024CTF/">https://m-brumbelow.github.io/posts/MVS2024CTF/</a></li>
 130 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/roles.py</a></li>
 131 | 			</ul>
 132 | 	</ul>
 133 | </div>
 134 | 
 135 | <p>
 136 | <h2 style="text-align: left;"><b>"/property" folder</b></h2>
 137 | </p>
 138 | 
 139 | <div>
 140 | 	<ul>
 141 | 		<li><b>/property/persistent_properties</b></li>
 142 | 			<ul>
 143 | 				<li><b>Wipeout! Detecting Android Factory Resets</b><br /><a href="https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/">https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/</a></li>
 144 | 				<li><b>aLEAPP plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/persistentProp.py</a></li>
 145 | 			</ul>
 146 | 	</ul>
 147 | </div>
 148 | 
 149 | 
 150 | <p>
 151 | <h2 style="text-align: left;"><b>"/system", "/system_ce" and "/system_de" folders</b></h2>
 152 | </p>
 153 | 
 154 | <div>
 155 | 	<ul style="text-align: left;">
 156 | 		<li><b>/system/appops/</b></li>
 157 | 			<ul>
 158 | 				<li><b>Snooping on Android 12’s Privacy Dashboard</b><br /><a href="https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/">https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/</a></li>
 159 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 160 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 161 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/discreteNative.py</a></li>
 162 | 			</ul>
 163 | 		<li><b>/system/batteryusagestats/</b></li>
 164 | 		<li><b>/system/job/jobs.xml</b></li>
 165 | 		<li><b>/system/netstats/</b></li>
 166 | 			<ul>
 167 | 				<li><b>Burn After Reading: Expunging Execution Footprints of Android Apps</b><br /><a href="https://lijuanru.com/publications/nss18.pdf">https://lijuanru.com/publications/nss18.pdf</a></li>
 168 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 169 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 170 | 			</ul>
 171 | 		<li><b>/system/procstats/</b></li>
 172 | 			<ul>
 173 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 174 | 			</ul>
 175 | 		<li><b>/system/sync/accounts.xml</b></li>
 176 | 			<ul>
 177 | 				<li><b>Who is the owner of the mobile device?</b><br /><a href="https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/">https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/</a><br /></li>				
 178 | 				<li><b>Clockin’ In with Google’s Wear OS</b><br /><a href="https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/">https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/</a></li>
 179 | 				<li><b>Super Sunday Funday Forensic Challenge - Update 4</b><br /><a href="https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html">https://www.hecfblog.com/2014/09/super-sunday-funday-forensic-challenge_15.html</a></li>
 180 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 181 | 			</ul>
 182 | 		<li><b>/system/shutdown-checkpoints/</b></li>
 183 | 			<ul>
 184 | 				<li><b>Shutdown Checkpoints in Android 12</b><br /><a href="https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html">https://www.stark4n6.com/2022/01/shutdown-checkpoints-in-android-12.html</a></li>
 185 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 186 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/shutdown_checkpoints.py</a></li>
 187 | 			</ul>
 188 | 		<li><b>/system/users/0.xml</b></li>
 189 | 			<ul>
 190 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 191 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
 192 | 				<li><b>Forensic analysis of IoT ecosystem</b><br /><a href="https://hal.archives-ouvertes.fr/hal-03369836/document">https://hal.archives-ouvertes.fr/hal-03369836/document</a></li>
 193 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 194 | 			</ul>
 195 | 		<li><b>/system/users/0/app_idle_stats.xml</b></li>
 196 | 		<li><b>/system/users/0/settings_global.xml</b></li>
 197 | 			<ul>
 198 | 				<li><b>Analysis of Android settings during a forensic investigation</b><br /><a href="https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html">https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html</a></li>
 199 | 			</ul>		
 200 | 		<li><b><b>/system/users/0/</b>settings_secure.xml</b></li>
 201 | 			<ul>
 202 | 				<li><b>Cellebrite CTF 2021 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li>
 203 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 204 | 				<li><b>Examining A Malware-Infected Android Phone. This Android Is Not Alright.</b><br /><a href="https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/">https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/</a></li>
 205 | 				<li><b>Analysis of Android settings during a forensic investigation</b><br /><a href="https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html">https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html</a></li>
 206 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 207 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 208 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 209 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/settingsSecure.py</a><br/><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py</a></li>
 210 | 			</ul>
 211 | 		<li><b><b>/system/users/0/</b>settings_ssaid.xml</b></li>
 212 | 			<ul>
 213 | 				<li><b>Forensic analysis of instant messengers: Decrypt Signal, Wickr, and Threema</b><br /><a href="https://www.sciencedirect.com/science/article/pii/S2666281722000166">https://www.sciencedirect.com/science/article/pii/S2666281722000166</a></li>
 214 | 				<li><b>Investigating Android Wickr</b><br /><a href="https://forensafe.com/blogs/Android_Wickr.html">https://forensafe.com/blogs/Android_Wickr.html</a></li>				
 215 | 			</ul>
 216 | 		<li><b><b>/system/users/0/</b>settings_system.xml</b></li>
 217 | 			<ul>
 218 | 				<li><b>Android - Roles and Permissions (Android 10/11)</b><br /><a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li>
 219 | 				<li><b>Analysis of Android settings during a forensic investigation</b><br /><a href="https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html">https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html</a></li>
 220 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 221 | 			</ul>
 222 | 		<li><b>/system/users/service/data/eRR.p</b></li>
 223 | 			<ul>
 224 | 				<li><b>DeRR.p. Investigating Power Events on Samsung Devices</b><br /><a href="https://thebinaryhick.blog/2024/04/07/__trashed/">https://thebinaryhick.blog/2024/04/07/__trashed/</a></li>
 225 | 				<li><b>Wipeout! Detecting Android Factory Resets</b><br /><a href="https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/">https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/</a></li>
 226 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 227 | 				<li><b>Comparison, Evolution and Challenges of Mobile Phone Batteries in Forensic Study of Role of a Mobile Battery of an Android Xiaomi Phone</b><br /><a href="https://www.jetir.org/papers/JETIR2408628.pdf">https://www.jetir.org/papers/JETIR2408628.pdf</a></li>
 228 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/errp.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/errp.py</a></li>            
 229 | 			</ul>
 230 | 		<li><b>/system/appops.xml</b></li>
 231 | 			<ul>
 232 | 				<li><b>Snooping on Android 12’s Privacy Dashboard</b><br /><a href="https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/">https://thebinaryhick.blog/2022/01/22/snooping-on-android-12s-privacy-dashboard/</a></li>
 233 | 				<li><b>Wipeout! Detecting Android Factory Resets</b><br /><a href="https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/">https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/</a></li>
 234 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appopSetupWiz.py</a><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appops.py</a></li>
 235 | 				<li><b>Digital Forensic Practices and Methodologies for AI Speaker Ecosystems</b><br /><a href="https://www.sciencedirect.com/science/article/pii/S1742287619301628">https://www.sciencedirect.com/science/article/pii/S1742287619301628</a></li>
 236 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 237 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 238 | 			</ul>
 239 | 		<li><b>/system/batterystats.bin</b></li>
 240 | 			<ul>
 241 | 				<li><b>Video Aficionado: We Know What You Are Watching<br /></b><a href="https://par.nsf.gov/servlets/purl/10215810">https://par.nsf.gov/servlets/purl/10215810</a></li>
 242 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 243 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 244 | 				<li><b>Comparison, Evolution and Challenges of Mobile Phone Batteries in Forensic Study of Role of a Mobile Battery of an Android Xiaomi Phone</b><br /><a href="https://www.jetir.org/papers/JETIR2408628.pdf">https://www.jetir.org/papers/JETIR2408628.pdf</a></li>
 245 | 			</ul>
 246 | 		<li><b>/system/batterystats-checkin.bin</b></li>
 247 | 			<ul>
 248 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 249 | 			</ul>		
 250 | 		<li><b>/system/batterystats-daily.xml</b></li>
 251 | 			<ul>
 252 | 				<li><b>Every Step You Take: Application and Network Usage in Android</b><br /><a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li>
 253 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 254 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 255 | 			</ul>
 256 | 		<li><b>/system/deviceidle.xml</b></li>
 257 | 		<li><b>/system/locksettings.db</b></li>
 258 | 			<ul>
 259 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 260 | 				<li><b>New Year Challenge CyberTalents CTF 2025|Forensics Writeup</b><br /><a href="https://medium.com/@SIGMA_001/new-year-challenge-cybertalents-ctf-2025-forensics-writeup-dd5c46e126c4">https://medium.com/@SIGMA_001/new-year-challenge-cybertalents-ctf-2025-forensics-writeup-dd5c46e126c4</a></li>
 261 | 			</ul>
 262 | 		<li><b>/system/netpolicy.xml</b></li>
 263 | 			<ul>
 264 | 				<li><b>Cellebrite CTF 2021 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li>
 265 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 266 | 				<li><b>Cellebrite CTF 2021 Writeup</b><br /><a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a></li>
 267 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 268 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>				
 269 | 			</ul>
 270 | 		<li><b>/system/notification_policy.xml</b></li>
 271 | 			<ul>
 272 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 273 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 274 | 				<li><b>Forensic Analysis of Android Notifications' History</b><br /><a href="https://ieeexplore.ieee.org/document/10679344">https://ieeexplore.ieee.org/document/10679344</a></li>				
 275 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/notificationHistory.py</a></li>            
 276 | 			</ul>
 277 | 		<li><b>/system/PkgPredictions.db</b></li>
 278 | 			<ul>
 279 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 280 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/pkgPredictions.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/pkgPredictions.py</a></li>
 281 | 			</ul>
 282 | 		<li><b>/system/SemWifiApContentProvider</b></li>
 283 | 			<ul>
 284 | 				<li><b>Part 2: CTF 2022 Write Up – Heisenberg’s Android</b><br /><a href="https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/">https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/</a></li>
 285 | 			</ul>
 286 | 		<li><b>/system/SimCard.dat</b></li>
 287 | 			<ul>
 288 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 289 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
 290 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 291 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 292 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 293 | 			</ul>
 294 | 		<li><b>/system/WifiConfigStore.db</b></li>
 295 | 		<li><b>/system/WifiHistory.db</b></li>
 296 | 		<li><b>/system/wifigeofence.db</b></li>
 297 | 			<ul>
 298 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 299 | 			</ul>
 300 | 		<li><b>/system/packages.xml</b></li>
 301 | 			<ul>
 302 | 				<li><b>Android - Roles and Permissions (Android 10/11)</b><br /><a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li>
 303 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 304 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 305 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 306 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 307 | 				<li><b>Mobile Forensics: Discovering the Undiscovered</b><br /><a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li>
 308 | 				<li><b>Some artifacts in the /data/system/ directory</b><br /><a href="http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html">http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html</a></li>
 309 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 310 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 311 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageInfo.py</a><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/permissions.py</a></li>
 312 | 			</ul>
 313 | 		<li><b>/system/packages.list</b></li>
 314 | 			<ul>
 315 | 				<li><b>Android - Roles and Permissions (Android 10/11)</b><br /><a href="https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html">https://blog.d204n6.com/2021/01/android-roles-and-permissions-android.html</a></li>
 316 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 317 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 318 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 319 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 320 | 				<li><b>Learning Android Forensics - Second Edition</b><br /><a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li>
 321 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a><br /></li>
 322 | 				<li><b>Learning Android Forensics - Second Edition</b><br /><a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li>
 323 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/packageGplinks.py</a></li>
 324 | 			</ul>
 325 | 		<li><b>/system_ce/0/accounts_ce.db<br /></b></li>
 326 | 			<ul>
 327 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 328 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2023<br /></b><a href="https://cts-forensics.com/reports/23-5550_Web.pdf">https://cts-forensics.com/reports/23-5550_Web.pdf</a></li>
 329 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
 330 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 331 | 				<li><b>Android - Tracking Device Migration</b><br /><a href="https://blog.d204n6.com/2021/06/android-tracking-device-migration.html">https://blog.d204n6.com/2021/06/android-tracking-device-migration.html</a></li>
 332 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 333 | 				<li><b>Magnet Virtual Summit 2024 CTF - Android</b><br /><a href="https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html">https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html</a></li>
 334 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 335 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 336 | 				<li><b>Investigating Android Accounts</b><br /><a href="https://forensafe.com/blogs/Android_Accounts.html">https://forensafe.com/blogs/Android_Accounts.html</a></li>				
 337 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_ce.py</a></li>
 338 | 			</ul>
 339 | 		<li><b>/system_ce/notification_history/</b></li>
 340 | 			<ul>
 341 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 342 | 				<li><b>Forensic Analysis of Android Notifications' History</b><br /><a href="https://ieeexplore.ieee.org/document/10679344">https://ieeexplore.ieee.org/document/10679344</a></li>				
 343 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/notificationHistory.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/notificationHistory.py</a></li>
 344 | 			</ul>
 345 | 		<li><b>/system_ce/recent_images/</b></li>
 346 | 			<ul>
 347 | 				<li><b>Mobile Forensics: Discovering the Undiscovered<br /></b><a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li>
 348 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 349 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 350 | 				<li><b>Android Recent Tasks XML Parser</b><br /><a href="https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html</a></li>
 351 | 				<li><b>Every Step You Take: Application and Network Usage in Android</b><br /><a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li>
 352 | 				<li><b>Digital Forensic Practices and Methodologies for AI Speaker Ecosystems</b><br /><a href="https://www.sciencedirect.com/science/article/pii/S1742287619301628">https://www.sciencedirect.com/science/article/pii/S1742287619301628</a></li>
 353 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 354 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py</a></li>
 355 | 			</ul>
 356 | 		<li><b>/system_ce/recent_tasks/</b></li>
 357 | 			<ul>
 358 | 				<li><b>Mobile Forensics: Discovering the Undiscovered</b><br /><a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li>
 359 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 360 | 				<li><b>Android Recent Tasks XML Parser</b><br /><a href="https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html</a></li>
 361 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 362 | 				<li><b>Digital Forensic Practices and Methodologies for AI Speaker Ecosystems<br /></b><a href="https://www.sciencedirect.com/science/article/pii/S1742287619301628">https://www.sciencedirect.com/science/article/pii/S1742287619301628</a></li>
 363 | 				<li><b>Corroboration. That Is All.</b><br /><a href="https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/">https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/</a></li>
 364 | 				<li><b>Every Step You Take: Application and Network Usage in Android</b><br /><a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li>
 365 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 366 | 				<li><b>Write-up Magnet Weekly CTF</b><br /><a href="https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html">https://www.cloud-response.com/2020/10/write-up-magnet-weekly-ctf.html</a></li>
 367 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py</a></li>
 368 | 			</ul>
 369 | 		<li><b>/system_ce/shortcuts/</b></li>
 370 | 		<li><b>/system_ce/snapshots/</b></li>
 371 | 			<ul>
 372 | 				<li><b>Corroboration. That Is All.</b><br /><a href="https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/">https://thebinaryhick.blog/2021/06/17/corroboration-that-is-all/</a></li>
 373 | 				<li><b>Android Recent Tasks XML Parser</b><br /><a href="https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-recent-tasks-xml-parser.html</a></li>
 374 | 				<li><b>Mobile Forensics: Discovering the Undiscovered</b><br /><a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li>
 375 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 376 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 377 | 				<li><b>Magnet Virtual Summit 2022 CTF - Android</b><br /><a href="https://www.stark4n6.com/2022/05/magnet-virtual-summit-2022-ctf-android.html">https://www.stark4n6.com/2022/05/magnet-virtual-summit-2022-ctf-android.html</a></li>
 378 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/recentactivity.py</a></li>
 379 | 			</ul>
 380 | 		<li><b>/system_ce/usagestats/</b></li>
 381 | 			<ul>
 382 | 				<li><b>Android Usagestats XML Parser</b><br /><a href="https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html">https://abrignoni.blogspot.com/2019/02/android-usagestats-xml-parser.html</a></li>
 383 | 				<li><b>Identifying the Android Operating System Version thru UsageStats</b><br /><a href="https://www.sans.org/white-papers/40265/">https://www.sans.org/white-papers/40265/</a></li>
 384 | 				<li><b>Usagestats on Android 10 (Q)</b><br /><a href="http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html">http://www.swiftforensics.com/2020/01/usagestats-on-android-10-q.html</a></li>
 385 | 				<li><b>Mobile Forensics: Discovering the Undiscovered</b><br /><a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li>
 386 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 387 | 				<li><b>Some artifacts in the /data/system/ directory</b><br /><a href="http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html">http://freeandroidforensics.blogspot.com/2014/11/some-artifacts-in-datasystem-directory.html</a></li>
 388 | 				<li><b>Android Dumpsys Analysis to Indicate Driver Distraction</b><br /><a href="https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf">https://ccdcoe.org/uploads/2021/03/Android-Dumpsys-Analysis-to-Indicate-Driver-Distraction.pdf</a></li>
 389 | 				<li><b>Every Step You Take: Application and Network Usage in Android</b><br /><a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li>
 390 | 				<li><b>Tracking traces of deleted applications</b><br /><a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a><br /><a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li>
 391 | 				<li><b>Android version without the build.props file</b><br /><a href="https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html">https://abrignoni.blogspot.com/2021/04/android-version-without-buildprops-file.html</a></li>
 392 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 393 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 394 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 395 | 				<li><b>Android Internals</b><br /><a href="http://newandroidbook.com/Book/2-Excerpt-Data.pdf">http://newandroidbook.com/Book/2-Excerpt-Data.pdf</a></li>
 396 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 397 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestats.py</a><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/usagestatsVersion.py</a></li>
 398 | 			</ul>
 399 | 		<li><b>/system_de/0/accounts_de.db</b></li>
 400 | 			<ul>
 401 | 				<li><b>Android - Tracking Device Migration<br /></b><a href="https://blog.d204n6.com/2021/06/android-tracking-device-migration.html">https://blog.d204n6.com/2021/06/android-tracking-device-migration.html</a></li>
 402 | 				<li><b>Clockin’ In with Google’s Wear OS</b><br /><a href="https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/">https://thebinaryhick.blog/2021/01/13/clockin-in-with-googles-wear-os/</a></li>
 403 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 404 | 				<li><b>Investigating Android Accounts</b><br /><a href="https://forensafe.com/blogs/Android_Accounts.html">https://forensafe.com/blogs/Android_Accounts.html</a></li>				
 405 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 406 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 407 | 				<li><b>Magnet Virtual Summit 2024 CTF - Android</b><br /><a href="https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html">https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html</a></li>
 408 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/accounts_de.py</a></li>
 409 | 			</ul>
 410 | 	</ul>
 411 | </div>
 412 | 
 413 | <p>
 414 | <h2 style="text-align: left;"><b>"/user_de" folder</b></h2>
 415 | </p>
 416 | 
 417 | <div>
 418 | 	<ul>
 419 | 		<li><b>/user_de/0/com.android.bluetooth/bonddevice.db</b></li>
 420 | 			<ul>
 421 | 				<li><b>Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones</b><br /><a   href="https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/">https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/</a>
 422 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 423 | 			</ul>
 424 | 		<li><b>/user_de/0/com.android.providers.telephony/databases/telephony.db</b></li>
 425 | 			<ul>
 426 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 427 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
 428 | 				<li><b>Cellebrite CTF 2021 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html">https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-heisenbergs-android.html</a></li>
 429 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 430 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 431 | 				<li><b>Mo’ SIMs, Mo’ Problems. Examining Phones with Dual SIMs.</b><br /><a href="https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/">https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/</a></li>				
 432 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 433 | 				<li><b>Cellebrite CTF 2021 Writeup</b><br /><a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a></li>
 434 | 				<li><b>Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device</b><br /><a href="https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/">https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/</a></li>
 435 | 				<li><b>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts</b><br /><a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li>
 436 | 				<li><b>Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation&nbsp;</b><br /><a href="https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf">https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf</a></li>
 437 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 438 | 				<li><b>Magnet Virtual Summit 2024 CTF - Android</b><br /><a href="https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html">https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html</a></li>				
 439 | 				<li><b>2024 Magnet Virtual Summit CTF Walkthrough</b><br /><a href="https://m-brumbelow.github.io/posts/MVS2024CTF/">https://m-brumbelow.github.io/posts/MVS2024CTF/</a></li>
 440 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 441 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/siminfo.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/siminfo.py</a></li>
 442 | 			</ul>
 443 | 		<li><b>/user_de/0/com.android.settings/databases/applist.db</b></li>
 444 | 		<li><b>/user_de/0/com.samsung.accessibility/shared_prefs/accessibility_prefs.xml</b></li>
 445 | 		<li><b>/user_de/0/com.sec.imsservice/shared_prefs/capdiscovery_0.xml</b></li>
 446 | 	</ul>
 447 | </div>
 448 | 
 449 | <p>
 450 | <h2 style="text-align: left;"><b>"/data" folder</b></h2>
 451 | </p>
 452 | 
 453 | <p>
 454 | <h3 style="text-align: left;"><b>Google Digital Wellbeing (com.google.android.apps.wellbeing)</b></h3>
 455 | </p>
 456 | 
 457 | <div>
 458 | 	<ul>
 459 | 		<li><b>/data/com.google.android.apps.wellbeing/databases/app_usage<br /></b></li>
 460 | 			<ul>
 461 | 				<li><b>Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity.</b><br /><a href="https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/">https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/</a></li>
 462 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 463 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 464 | 				<li><b>Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device</b><br /><a href="https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/">https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/</a></li>
 465 | 				<li><b>Investigating Android Digital Wellbeing</b><br /><a href="https://forensafe.com/blogs/androidDigitalWellbeing.html">https://forensafe.com/blogs/androidDigitalWellbeing.html</a></li>				
 466 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 467 | 				<li><b>Reconstructing Distracted Driving – Texting While Driving Forensics<br /></b><a href="https://buntingdigitalforensics.us/insights/reconstructing-distraction/">https://buntingdigitalforensics.us/insights/reconstructing-distraction/</a></li>
 468 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/wellbeing.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/wellbeing.py</a></li>         
 469 | 			</ul>
 470 | 	</ul>
 471 | </div>
 472 | 
 473 | <p>
 474 | <h3 style="text-align: left;"><b>Samsung Digital Wellbeing (com.samsung.forest)</b></h3>
 475 | </p>
 476 | 
 477 | <div>
 478 | 	<ul>
 479 | 		<li><b>/data/</b><b>com.samsung.forest</b><b>/databases/dwbCommon.db</b></li>
 480 | 			<ul>
 481 | 				<li><b>Walking the Android (time)line. Using Android’s Digital Wellbeing to timeline Android activity.<br /></b><a href="https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/">https://thebinaryhick.blog/2020/02/22/walking-the-android-timeline-using-androids-digital-wellbeing-to-timeline-android-activity/</a></li>
 482 | 				<li><b>(Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing<br /></b><a href="https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/">https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/</a></li>  
 483 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 484 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 485 | 				<li><b>Investigating Android Digital Wellbeing</b><br /><a href="https://forensafe.com/blogs/androidDigitalWellbeing.html">https://forensafe.com/blogs/androidDigitalWellbeing.html</a></li>
 486 | 				<li><b>Cellebrite CTF 2023 Recap: Answers on Sharon’s Android</b><br /><a href="https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/">https://cellebrite.com/en/cellebrite-ctf-2023-recap-sharons-android/</a></li>
 487 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/swellbeing.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/swellbeing.py</a></li>
 488 | 			</ul>
 489 | 	</ul>
 490 | </div>
 491 | 
 492 | <p>
 493 | <h3 style="text-align: left;"><b>Google Docs (com.google.android.apps.docs)</b></h3>
 494 | </p>
 495 | 
 496 | <div>
 497 | 	<ul>
 498 | 		<li><b>/data/com.google.android.apps.docs/databases/cello.db</b></li>
 499 | 			<ul>         
 500 | 				<li><b>Google Docs - Cello & DocList DBs</b><br/><a href="https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html">https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html</a></li>
 501 | 				<li><b>Android Google Drive</b><br/><a href="https://forensafe.com/blogs/AndroidGoogleDrive.html">https://forensafe.com/blogs/AndroidGoogleDrive.html</a></li>
 502 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 503 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Cello.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Cello.py</a></li>
 504 | 			</ul>
 505 | 		<li><b>/data/com.google.android.apps.docs/databases/DocList.db</b></li>
 506 | 			<ul>
 507 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py</a></li>
 508 | 				<li><b>Google Docs - Cello &amp; DocList DBs</b><br /><a href="https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html">https://www.stark4n6.com/2020/12/google-docs-cello-doclist-dbs.html</a></li>
 509 | 				<li><b>Android Google Drive</b><br/><a href="https://forensafe.com/blogs/AndroidGoogleDrive.html">https://forensafe.com/blogs/AndroidGoogleDrive.html</a></li>
 510 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 511 | 				<li><b>Digital Forensic Investigation of Cloud Storage Services</b><br /><a href="https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf">https://arxiv.org/ftp/arxiv/papers/1709/1709.10395.pdf</a></li>
 512 | 				<li><b>Android Cloud Forensics - Final Findings</b><br /><a href="http://obrienforensics.blogspot.com/2014/04/final-findings.html">http://obrienforensics.blogspot.com/2014/04/final-findings.html</a><br /></li>
 513 | 				<li><b>Digital Evidence Identification on Google Drive in Android Device Using NIST Mobile Forensic Method</b><br /><a href="https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf">https://pdfs.semanticscholar.org/b699/e47687819041e2cbf69fa6d6afbd0c6a3fc2.pdf</a></li>
 514 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
 515 | 				<li><b>Proposed Method for Mobile Forensics Investigation Analysis of Remnant Data on Google Drive Client<br /></b><a href="https://jit.ndhu.edu.tw/article/download/1795/1801">https://jit.ndhu.edu.tw/article/download/1795/1801</a></li>
 516 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 517 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/DocList.py</a></li>
 518 | 			</ul>
 519 | 	</ul>
 520 | </div>
 521 | 
 522 | <p>
 523 | <h3 style="text-align: left;"><b>Files by Google (com.google.android.apps.nbu.files)</b></h3>
 524 | </p>
 525 | 
 526 | <div>   
 527 | 	<ul>
 528 | 		<li><b>/data/com.google.android.apps.nbu.files/databases/files_master_database</b></li>
 529 | 			<ul>
 530 | 				<li><b>Files By Google: More Mobile Explorer Artifacts</b><br /><a href="https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html">https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html</a></li><li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py</a></li></ul><li><b>/data/com.google.android.apps.nbu.files/databases/search_history_database</b></li><ul><li><b>Files By Google: More Mobile Explorer Artifacts</b><br /><a href="https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html">https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html</a></li><li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py</a></li>
 531 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py</a></li>
 532 | 			</ul>
 533 | 		<li><b>/data/com.google.android.apps.nbu.files/databases/search_history_database</b></li>
 534 | 			<ul>
 535 | 				<li><b>Files By Google: More Mobile Explorer Artifacts</b><br /><a href="https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html">https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html</a></li><li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_FilesMaster.py</a></li></ul><li><b>/data/com.google.android.apps.nbu.files/databases/search_history_database</b></li><ul><li><b>Files By Google: More Mobile Explorer Artifacts</b><br /><a href="https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html">https://www.stark4n6.com/2021/01/files-by-google-more-mobile-explorer.html</a></li><li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle_SearchHistory.py</a></li>
 536 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/FilesByGoogle.py</a></li>
 537 | 			</ul>		
 538 | 	</ul>
 539 | </div>
 540 | 
 541 | <p>
 542 | <h3 style="text-align: left;"><b>Device Health Services (com.google.android.apps.turbo)</b></h3>
 543 | </p>
 544 | 
 545 | <div>
 546 | 	<ul>
 547 | 		<li><b>/data/com.google.android.apps.turbo/databases/turbo.db</b></li>
 548 | 			<ul>
 549 | 				<li><b>Charging Battery with Turbo DB</b><br /><a href="https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html">https://www.stark4n6.com/2020/12/charging-battery-with-turbo-db.html</a></li>
 550 | 				<li><b>Part 2: CTF 2022 Write Up – Heisenberg’s Android</b><br /><a href="https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/">https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/</a></li>
 551 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 552 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 553 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 2)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html</a></li>				
 554 | 				<li><b>Investigating Android Device Health Services</b><br /><a href="https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html">https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html</a></li>								
 555 | 				<li><b>Turbo Speed: Parsing Device Health Services from Google</b><br /><a href="https://dfir.pubpub.org/pub/4can3p40/release/1">https://dfir.pubpub.org/pub/4can3p40/release/1</a></li>
 556 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py</a></li>
 557 | 			</ul>
 558 | 		<li><b>/data/com.google.android.apps.turbo/databases/bluetooth.db</b></li>
 559 | 			<ul>
 560 | 				<li><b>Turbo Strikes Again - Tracking Bluetooth Device Battery</b><br /><a href="https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html">https://www.stark4n6.com/2021/06/turbo-strikes-again-tracking-bluetooth.html</a></li>
 561 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 562 | 				<li><b>Investigating Android Device Health Services</b><br /><a href="https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html">https://www.forensafe.com/blogs/AndroidDeviceHealthServices.html</a></li>								
 563 | 				<li><b>Turbo Speed: Parsing Device Health Services from Google</b><br /><a href="https://dfir.pubpub.org/pub/4can3p40/release/1">https://dfir.pubpub.org/pub/4can3p40/release/1</a></li>
 564 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_Battery.py</a></li>
 565 | 			</ul>
 566 | 		<li><b>/data/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml</b></li>
 567 | 			<ul>
 568 | 				<li><b>Turbo Pt. 3 - Device Health Services Application Usage</b><br /><a href="https://www.stark4n6.com/2021/06/turbo-application-usage.html">https://www.stark4n6.com/2021/06/turbo-application-usage.html</a></li>
 569 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 570 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 571 | 				<li><b>Turbo Speed: Parsing Device Health Services from Google</b><br /><a href="https://dfir.pubpub.org/pub/4can3p40/release/1">https://dfir.pubpub.org/pub/4can3p40/release/1</a></li>
 572 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/Turbo_AppUsage.py</a></li>
 573 | 			</ul>
 574 | 	</ul>
 575 | </div>
 576 | 
 577 | <p>
 578 | <h3 style="text-align: left;"><b>Device Personalization Services (DPS) (com.google.android.as)</b></h3>
 579 | </p>
 580 | 
 581 | <div>
 582 | 	<ul>
 583 | 		<li><b>/data/com.google.android.as/databases/reflection_gel_events.db</b></li>
 584 | 			<ul>
 585 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 586 | 				<li><b>Walking the Android (time)line Part 2 – Using Android’s Device Personalization Services to timeline user activity</b><br /><a href="https://thebinaryhick.blog/2020/05/16/walking-the-android-timeline-part-2-using-androids-device-personalization-services-to-timeline-user-activity/">https://thebinaryhick.blog/2020/05/16/walking-the-android-timeline-part-2-using-androids-device-personalization-services-to-timeline-user-activity/</a></li>
 587 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/usageapps.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/usageapps.py</a></li>
 588 | 			</ul>
 589 | 		<li><b>/data/com.google.android.as/databases/SimpleStorage</b></li>
 590 | 			<ul>         
 591 | 				<li><b>Cellebrite’s CTF 2023 Recap: Answers for Russell’s Android Device</b><br /><a href="https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/">https://cellebrite.com/en/cellebrites-ctf-2023-recap-answers-for-russells-android-device/</a></li>
 592 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 593 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/SimpleStorage_applaunch.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/SimpleStorage_applaunch.py</a></li>
 594 | 			</ul>      
 595 | 	</ul>
 596 | </div>
 597 | 
 598 | <p>
 599 | <h3 style="text-align: left;"><b>Settings Services (com.google.android.settings.intelligence)</b></h3>
 600 | </p>
 601 | 
 602 | <div>
 603 | 	<ul>
 604 | 		<li><b>/data/com.google.android.settings.intelligence/databases/battery-usage-db-v4</b></li>
 605 | 			<ul>
 606 | 				<li><b>Application Battery Usage via Settings Services</b><br /><a href="https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html">https://www.stark4n6.com/2021/12/application-battery-usage-via-settings.html</a></li>
 607 | 				<li><b>Examining A Malware-Infected Android Phone. This Android Is Not Alright.</b><br /><a href="https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/">https://thebinaryhick.blog/2022/04/09/examining-a-malware-infected-android-phone-this-android-is-not-alright/</a></li>
 608 | 				<li><b>Android System Artifacts: Forensic Analysis of Device Information and Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-device">https://belkasoft.com/android-system-artifacts-device</a></li>
 609 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 610 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v4.py</a></li>
 611 | 			</ul>
 612 | 	</ul>
 613 | 	<ul>
 614 | 		<li><b>/data/com.google.android.settings.intelligence/databases/battery-usage-db-v9</b></li>
 615 | 			<ul>
 616 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 617 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v9.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/battery_usage_v9.py</a></li>
 618 | 			</ul>
 619 | 		<li><b>/data/com.google.android.settings.intelligence/shared_prefs/setup_wizard_info.xml</b></li>
 620 | 			<ul>
 621 | 				<li><b>Wipeout! Detecting Android Factory Resets</b><br /><a href="https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/">https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/</a></li>
 622 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 623 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/setupWizardinfo.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/setupWizardinfo.py</a></li>
 624 | 			</ul>
 625 | 				<li><b>/data/com.google.android.settings.intelligence/shared_prefs/suggestions.xml</b></li>
 626 | 			<ul>
 627 | 				<li><b>Wipeout! Detecting Android Factory Resets</b><br /><a href="https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/">https://thebinaryhick.blog/2021/08/19/wipeout-detecting-android-factory-resets/</a></li>
 628 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 629 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/suggestions.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/suggestions.py</a></li>
 630 | 			</ul>
 631 | 	</ul>
 632 | </div>
 633 | 
 634 | <p>
 635 | <h3 style="text-align: left;"><b>Google Play Service (com.google.android.gms)</b></h3>
 636 | </p>
 637 | 
 638 | <div>
 639 | 	<ul style="text-align: left;">
 640 | 		<li><b>/data/com.google.android.gms/app_semanticlocation_rawsignal_db</b></li>
 641 | 			<ul>
 642 | 				<li><b>The Green Look Back. Android’s On-Device Location History</b><br /><a href="https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/">https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/</a></li>
 643 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appSemloc.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/appSemloc.py</a></li>				
 644 | 			</ul>
 645 | 		<li><b>/data/com.google.android.gms/app_semanticlocation_placeindex_cache</b></li>
 646 | 			<ul>
 647 | 				<li><b>The Green Look Back. Android’s On-Device Location History</b><br /><a href="https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/">https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/</a></li>
 648 | 			</ul>
 649 | 		<li><b>/data/com.google.android.gms/app_semanticlocation_odlh_cache</b></li>
 650 | 			<ul>
 651 | 				<li><b>The Green Look Back. Android’s On-Device Location History</b><br /><a href="https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/">https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/</a></li>
 652 | 			</ul>
 653 | 		<li><b>/data/com.google.android.gms/databases/cast.db</b></li>
 654 | 			<ul>
 655 | 				<li><b>An Android Casting (Device) Story: "cast.db"</b><br /><a href="https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html">https://deagler4n6blog.blogspot.com/2021/01/a-casting-story-castdb.html</a></li>
 656 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 657 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googleCast.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googleCast.py</a></li>            
 658 | 			</ul>
 659 | 		<li><b>/data/com.google.android.gms/databases/constellation.db</b></li>
 660 | 			<ul>
 661 | 				<li><b>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts</b><br /><a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li>
 662 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 663 | 			</ul>
 664 | 		<li><b>/data/com.google.android.gms/databases/gass.db</b></li>
 665 | 			<ul>
 666 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 667 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 668 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 669 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsGass.py</a></li>
 670 | 			</ul>
 671 | 		<li><b>/data/com.google.android.gms/databases/gms.notifications.db</b></li>
 672 | 		<li><b>/data/com.google.android.gms/databases/google_account_history.db</b></li>
 673 | 			<ul>
 674 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 675 | 			</ul>		
 676 | 		<li><b>/data/com.google.android.gms/databases/google_app_measurement.db</b></li>
 677 | 			<ul>
 678 | 				<li><b>Forensics on Android Applications<br /></b><a href="https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&amp;sequence=1">https://dione.lib.unipi.gr/xmlui/bitstream/handle/unipi/11306/Kitsaki_mte1618.pdf?isAllowed=y&amp;sequence=1</a></li>
 679 | 				<li><b>Forensic Analysis of the Bumble Dating App for Android</b><br /><a href="https://www.mdpi.com/2673-6756/2/1/16/htm">https://www.mdpi.com/2673-6756/2/1/16/htm</a></li>
 680 | 			</ul>
 681 | 		<li><b>/data/com.google.android.gms/databases/herrevad</b></li>
 682 | 			<ul>
 683 | 				<li><b>HERREVAD Databases Geo Location Artefacts</b><br /><a href="http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2017/02/herrevad-databases-geo-location.html</a></li>
 684 | 				<li><b>Update - HERREVAD Databases Geo Location Artefacts</b><br /><a href="http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2018/07/update-herrevad-databases-geo-location.html</a><br /></li>
 685 | 				<li><b>Update2 - HERREVAD Databases Geo Location Artefacts</b><br /><a href="http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2019/05/update2-herrevad-databases-geo-location.html</a></li>
 686 | 				<li><b>Update3 - HERREVAD Databases Geo Location Artefacts</b><br /><a href="http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html">http://trewmte.blogspot.com/2019/12/update3-herrevad-databases-geo-location.html</a></li>
 687 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
 688 | 			</ul>
 689 | 		<li><b>/data/com.google.android.gms/databases/icing_contacts.db</b></li>
 690 | 			<ul>
 691 | 				<li><b>Recovering data from broken screen Android phone - alternative</b><br /><a href="https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html">https://hackcorrelation.blogspot.com/2016/10/recovering-data-from-broken-screen.html</a></li>
 692 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 693 | 			</ul>
 694 | 		<li><b>/data/com.google.android.gms/databases/icing_mmssms.db</b></li>
 695 | 			<ul>
 696 | 				<li><b>Cellebrite-icing_mmssms.db-Parser</b><br /><a href="https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md">https://github.com/python-for-mobile-forensics/Cellebrite-icing_mmssms.db-Parser/blob/master/README.md</a></li>
 697 | 				<li><b>Android Messaging Forensics – SMS/MMS and Beyond</b><br /><a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li>
 698 | 			</ul>
 699 | 		<li><b>/data/data/com.google.android.gms/databases/MdpSimBasedDatabase</b></li>
 700 | 			<ul>
 701 | 				<li><b>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts</b><br /><a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li>
 702 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 703 | 			</ul>
 704 | 		<li><b>/data/com.google.android.gms/databases/NetworkUsage.db</b></li>
 705 | 			<ul>
 706 | 				<li><b>Providing Context to the Clues: Recovery and Reliability of Location Data from Android Devices</b><br /><a href="https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&amp;httpsredir=1&amp;article=2353&amp;context=etd">https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=&amp;httpsredir=1&amp;article=2353&amp;context=etd</a></li>
 707 | 			</ul>
 708 | 		<li><b>/data/com.google.android.gms/databases/ns.db</b></li>
 709 | 		<li><b>/data/com.google.android.gms/databases/reminders.db</b></li>
 710 | 			<ul>
 711 | 				<li><b>Smart Speakers Forensics</b><br /><a href="https://core.ac.uk/download/pdf/230544843.pdf">https://core.ac.uk/download/pdf/230544843.pdf</a></li>
 712 | 			</ul>
 713 | 		<li><b>/data/com.google.android.gms/files/fcm_queued_messages.ldb</b></li>
 714 | 			<ul>
 715 | 				<li><b>FCM Queued Messages on Android</b><br /><a href="https://www.cclsolutionsgroup.com/post/fcm-queued-messages-on-android">https://www.cclsolutionsgroup.com/post/fcm-queued-messages-on-android</a></li>
 716 | 				<li><b>Android Firebase Cloud Messaging</b><br /><a href="https://forensafe.com/blogs/AndroidFCM.html">https://forensafe.com/blogs/AndroidFCM.html</a></li>
 717 | 				<li><b>Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network</b><br /><a href="https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/">https://thebinaryhick.blog/2024/08/23/not-all-androids-who-wonder-are-lost-a-look-at-androids-find-my-device-network/</a></li>
 718 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 719 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/FCMQueuedMessagesDump.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/FCMQueuedMessagesDump.py</a></li>
 720 | 			</ul>
 721 | 		<li><b>/data/com.google.android.gms/shared_prefs/batterystats.xml</b></li>
 722 | 			<ul>
 723 | 				<li><b>Every Step You Take: Application and Network Usage in Android</b><br /><a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li>
 724 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 725 | 			</ul>
 726 | 		<li><b>/data/com.google.android.gms/shared_prefs/adid_settings.xml</b></li>
 727 | 		<li><b>/data/com.google.android.gms/shared_prefs/BackupAccount.xml</b></li>
 728 | 			<ul>
 729 | 				<li><b>Investigating Android Accounts</b><br /><a href="https://forensafe.com/blogs/Android_Accounts.html">https://forensafe.com/blogs/Android_Accounts.html</a></li>				
 730 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 731 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
 732 | 			</ul>
 733 | 		<li><b>/data/com.google.android.gms/shared_prefs/Checkin.xml</b></li>
 734 | 			<ul>
 735 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 736 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
 737 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 738 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 739 | 				<li><b>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts</b><br /><a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li>
 740 | 				<li><b>Cellebrite CTF 2021 Writeup</b><br /><a href="https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708">https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708</a></li>
 741 | 				<li><b>Cellebrite CTF 2022 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li>
 742 | 				<li><b>Investigating Android Last SIM</b><br /><a href="https://forensafe.com/blogs/Android_Last_SIM.html">https://forensafe.com/blogs/Android_Last_SIM.html</a></li>				
 743 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 744 | 			</ul>
 745 | 		<li><b>/data/com.google.android.gms/shared_prefs/nearbysharing:service:state.xml</b></li>
 746 | 			<ul>
 747 | 				<li><b>Nearby Share – AirDrop for Android (Return of the Unsolicited Richard Photograph)</b><br /><a href="https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/">https://thebinaryhick.blog/2020/08/22/nearby-share-airdrop-for-android-return-of-the-unsolicited-richard-photograph/</a></li>
 748 | 			</ul>
 749 | 		<li><b>/data/com.google.android.gms/shared_prefs/ULR_USER_PREFS.xml</b></li>
 750 | 			<ul>
 751 | 				<li><b>The Green Look Back. Android’s On-Device Location History<br /></b><a href="https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/">https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/</a></li>
 752 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/ulrUserprefs.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/ulrUserprefs.py</a></li>
 753 | 			</ul>
 754 | 	</ul>
 755 | </div>
 756 | 
 757 | <p>
 758 | <h3 style="text-align: left;"><b>Google Play Store (com.android.vending)</b></h3>
 759 | </p>
 760 | 
 761 | <div>
 762 | 	<ul>
 763 | 		<li><b>/data/com.android.vending/databases/data_usage.db</b></li>
 764 | 			<ul>
 765 | 				<li><b>Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications</b><br /><a href="https://link.springer.com/article/10.1007/s12243-022-00919-6">https://link.springer.com/article/10.1007/s12243-022-00919-6</a></li>
 766 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 767 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 768 | 			</ul>
 769 | 		<li><b>/data/com.android.vending/databases/frosting.db</b></li>
 770 | 			<ul>
 771 | 				<li><b>Analysis of application installation logs on Android systems</b><br /><a href="https://dl.acm.org/doi/10.1145/3297280.3297489">https://dl.acm.org/doi/10.1145/3297280.3297489</a></li>
 772 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 773 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>				
 774 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 775 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/frosting.py</a></li>
 776 | 			</ul>
 777 | 		<li><b>/data/com.android.vending/databases/install_queue.db</b></li>
 778 | 			<ul>
 779 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 780 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 781 | 				<li><b>When is an app not an app? Investigating WebAPKs on Android</b><br /><a href="https://www.cclsolutionsgroup.com/post/when-is-an-app-not-an-app-investigating-webapks-on-android">https://www.cclsolutionsgroup.com/post/when-is-an-app-not-an-app-investigating-webapks-on-android</a></li>								
 782 | 				<li><b>Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications</b><br /><a href="https://link.springer.com/article/10.1007/s12243-022-00919-6">https://link.springer.com/article/10.1007/s12243-022-00919-6</a></li>
 783 | 			</ul>
 784 | 		<li><b>/data/com.android.vending/databases/library.db</b></li>
 785 | 			<ul>
 786 | 				<li><b>Mobile Forensics: Discovering the Undiscovered</b><br /><a href="https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/">https://www.magnetforensics.com/blog/mobile-forensics-discovering-the-undiscovered/</a></li>
 787 | 				<li><b>Analysis of application installation logs on Android systems</b><br /><a href="https://dl.acm.org/doi/10.1145/3297280.3297489">https://dl.acm.org/doi/10.1145/3297280.3297489</a></li>
 788 | 				<li><b>CTF Cellebrite CTF 2020: Rene Gade</b><br /><a href="https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/">https://ciofecaforensics.com/2020/10/31/cellebrite-ctf-rene/</a></li>
 789 | 				<li><b>Tracking traces of deleted applications</b><br /><a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a><br /><a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li>
 790 | 				<li><b>Every Step You Take: Application and Network Usage in Android</b><br /><a href="https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html">https://docplayer.net/90183420-Every-step-you-take-application-and-network-usage-in-android.html</a></li>
 791 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 792 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 793 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 794 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsLibrary.py</a></li>
 795 | 			</ul>
 796 | 		<li><b>/data/com.android.vending/databases/localappstate.db</b></li>
 797 | 			<ul>
 798 | 				<li><b>Analysis of application installation logs on Android systems</b><br /><a href="https://dl.acm.org/doi/10.1145/3297280.3297489">https://dl.acm.org/doi/10.1145/3297280.3297489</a></li>
 799 | 				<li><b>Tracking traces of deleted applications</b><br /><a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a><br /><a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li>
 800 | 				<li><b>Part 2: CTF 2022 Write Up – Heisenberg’s Android</b><br /><a href="https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/">https://cellebrite.com/en/part-2-ctf-2022-write-up-heisenbergs-android/</a></li>
 801 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2015</b><br /><a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li>
 802 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
 803 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
 804 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 805 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
 806 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 807 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 808 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
 809 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 810 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 811 | 				<li><b>Investigating Android Installed Applications</b><br /><a href="https://forensafe.com/blogs/Android_InstalledApps.html">https://forensafe.com/blogs/Android_InstalledApps.html</a></li>				
 812 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 813 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/installedappsVending.py</a></li>
 814 | 			</ul>
 815 | 		<li><b>/data/com.android.vending/databases/package_verification.db</b></li>
 816 | 			<ul>
 817 | 				<li><b>Tracking traces of deleted applications</b><br /><a href="https://www.youtube.com/watch?v=4LcQm4ErXpA">https://www.youtube.com/watch?v=4LcQm4ErXpA</a><br /><a href="https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html">https://docplayer.net/148670626-Tracking-traces-of-deleted-applications-christopher-vance-alexis-brignoni.html</a></li>
 818 | 			</ul>
 819 | 		<li><b>/data/com.android.vending/databases/suggestions.db</b></li>
 820 | 			<ul>
 821 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2015</b><br /><a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li>
 822 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
 823 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
 824 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 825 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
 826 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 827 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 828 | 				<li><b>Android System Artifacts: Forensic Analysis of Application Usage</b><br /><a href="https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage">https://belkasoft.com/android-system-artifacts-forensic-analysis-of-application-usage</a></li>
 829 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 2)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html</a></li>				
 830 | 				<li><b>Magnet Virtual Summit 2024 CTF - Android</b><br /><a href="https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html">https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html</a></li>
 831 | 				<li><b>Investigating Android Playstore Search History</b><br /><a href="https://forensafe.com/blogs/Android_PlayStoreSearch.html">https://forensafe.com/blogs/Android_PlayStoreSearch.html</a></li>				
 832 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 833 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googlePlaySearches.py">https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/googlePlaySearches.py</a></li>            
 834 | 			</ul>
 835 | 		<li><b>/data/com.android.vending/databases/verify_apps.db</b></li>
 836 | 			<ul>
 837 | 				<li><b>Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications</b><br /><a href="https://link.springer.com/article/10.1007/s12243-022-00919-6">https://link.springer.com/article/10.1007/s12243-022-00919-6</a></li>
 838 | 			</ul>
 839 | 	</ul>
 840 | </div>
 841 | 
 842 | <p>
 843 | <h3 style="text-align: left;"><b>Google Quick Search (com.google.android.googlequicksearchbox)</b></h3>
 844 | </p>
 845 | 
 846 | <div>
 847 | 	<ul>	
 848 | 		<li><b>Google Search &amp; Personal Assistant data on android</b><br /><a href="http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html">http://www.swiftforensics.com/2020/03/google-search-personal-assistant-data.html</a></li>
 849 | 		<li><b>Google Search Bar &amp; Search Term History – Are You Finding Everything?</b><br /><a href="https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/">https://thebinaryhick.blog/2019/03/20/google-search-bar-search-term-history-are-you-finding-everything/</a></li>
 850 | 		<li><b>Forensic Investigation of Google Assistant</b><br /><a href="https://link.springer.com/article/10.1007/s42979-020-00285-x">https://link.springer.com/article/10.1007/s42979-020-00285-x</a></li>
 851 | 		<li><b>How Android Bluetooth Connections Can Determine if a Driver had Their Hands on the Wheel During an Accident</b><br /><a href="https://dfir.pubpub.org/pub/6ysxvhvc/release/1">https://dfir.pubpub.org/pub/6ysxvhvc/release/1</a></li>
 852 | 		<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
 853 | 		<li><b>DroidForensics: Accurate Reconstruction of Android Attacks via Multi-layer Forensic Logging</b><br /><a href="https://kyuhlee.github.io/publications/asiaccs17.pdf">https://kyuhlee.github.io/publications/asiaccs17.pdf</a></li>
 854 | 		<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 855 | 		<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 856 | 		<li><b>Magnet User Summit 2023 CTF - Android (Part 2)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html</a></li>				
 857 | 		<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchbox.py</a><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleQuickSearchboxRecent.py</a></li>
 858 | 	</ul>
 859 | </div>
 860 | 
 861 | <p>
 862 | <h3 style="text-align: left;"><b>Google Services Framework (com.google.android.gsf)</b></h3>
 863 | </p>
 864 | 
 865 | <div>
 866 | 	<ul>
 867 | 		<li><b>/data/com.google.android.gsf/databases/gservices.db</b></li>
 868 | 			<ul>
 869 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022</b><br /><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
 870 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 871 | 			</ul>
 872 | 		<li><b>/data/com.google.android.gsf/databases/googlesettings.db</b></li>
 873 | 			<ul>
 874 | 				<li><b>Forensic Analysis of Wireless Networking Evidence of Android Smartphones</b><br /><a href="https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf">https://www.fortoo.eu/m/page-media/4/Andriotis-2012-1-wifs.pdf</a></li>
 875 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 876 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
 877 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/pSettings.py</a></li>
 878 | 			</ul>
 879 | 	</ul>
 880 | </div>
 881 | 
 882 | <p>
 883 | <h3 style="text-align: left;"><b>Messages (com.google.android.apps.messaging)</b></h3>
 884 | </p>
 885 | 
 886 | <div>
 887 | 	<ul>
 888 | 		<li><b>/data/com.google.android.apps.messaging/databases/bugle_db</b></li>
 889 | 			<ul>
 890 | 				<li><b>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts</b><br /><a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li>
 891 | 				<li><b>Android Messaging Forensics – SMS/MMS and Beyond</b><br /><a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li>
 892 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 893 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 894 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 895 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMessages.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMessages.py</a></li>
 896 | 			</ul>
 897 | 		<li><b>/data/com.google.android.apps.messaging/shared_prefs/sim_state_tracker.xml</b></li>
 898 | 			<ul>
 899 | 				<li><b>Magnet Virtual Summit 2025 CTF - Android/b><br /><a href="https://www.stark4n6.com/2025/03/magnet-virtual-summit-2025-ctf-android.html">https://www.stark4n6.com/2025/03/magnet-virtual-summit-2025-ctf-android.html</a></li>                  
 900 | 			</ul>
 901 | 	</ul>
 902 | </div>
 903 | 
 904 | <p>
 905 | <h3 style="text-align: left;"><b>Samsung One UI Home (com.sec.android.app.launcher)</b></h3>
 906 | </p>
 907 | 
 908 | <div>
 909 | 	<ul>
 910 | 		<li><b>Recreate Android apps, folders, and widget screen positions from a forensic extraction</b><br /><a href="https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html">https://abrignoni.blogspot.com/2019/10/recreate-android-apps-folders-and.html</a></li>
 911 | 	</ul>
 912 | </div>
 913 | 
 914 | <p>
 915 | <h3 style="text-align: left;"><b>Android Contacts Storage (</b><b>com.android.providers.contacts)</b></h3>
 916 | </p>
 917 | 
 918 | <div>
 919 | 	<ul>
 920 | 		<li><b>/data/com.android.providers.contacts/databases/calllog.db</b></li>
 921 | 			<ul>
 922 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 923 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 924 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
 925 | 				<li><b>Hex Diving — The Easy Way to Uncover Hidden Forensic Artifacts</b><br /><a href="https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/">https://cellebrite.com/en/hex-diving-the-easy-way-to-uncover-hidden-forensic-artifacts/</a></li>
 926 | 				<li><b>Calllog.db and SMS data on Android 7.0 Nougat</b><br /><a href="https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html">https://forensenellanebbia.blogspot.com/2018/10/calllogdb-and-sms-data-on-android-70.html</a><br /></li>
 927 | 				<li><b>Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation&nbsp;</b><br /><a href="https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf">https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf</a></li>
 928 | 				<li><b>Call Log query</b><br /><a href="https://github.com/kacos2000/Queries/blob/master/calllog_db.sql">https://github.com/kacos2000/Queries/blob/master/calllog_db.sql</a></li>
 929 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 930 | 				<li><b>Investigating Android Call logs</b><br /><a href="https://forensafe.com/blogs/Android_Call_logs.html">https://forensafe.com/blogs/Android_Call_logs.html</a></li>				
 931 | 				<li><b>Investigating Android SMS</b><br /><a href="https://forensafe.com/blogs/AndroidSMS.html">https://forensafe.com/blogs/AndroidSMS.html</a></li>				
 932 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 933 | 				<li><b>Road Trippin’ – Exploring Bluetooth Call Routes on Samsung Phones</b><br /><a   href="https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/">https://thebinaryhick.blog/2024/04/16/road-trippin-exploring-bluetooth-call-routes-on-samsung-phones/</a>
 934 | 				<li><b>Learning Android Forensics - Second Edition</b><br /><a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li>
 935 | 				<li><b>Practical Mobile Forensics - Fourth Edition</b><br /><a href="https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520">https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520</a></li>
 936 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllog.py</a></li>
 937 | 			</ul>
 938 | 		<li><b>/data/com.android.providers.contacts/databases/contacts2.db</b></li>
 939 | 			<ul>
 940 | 				<li><b>Open Source Mobile Device Forensics</b><br /><a href="https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf">https://smarterforensics.com/wp-content/uploads/2014/06/OpenSourceMobileForensics.pdf</a></li>
 941 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
 942 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
 943 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
 944 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
 945 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
 946 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 947 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
 948 | 				<li><b>Android Mobile Artifacts: A Treasure Trove of Digital Evidence in Crime Investigation&nbsp;</b><br /><a href="https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf">https://www.irjet.net/archives/V8/i8/IRJET-V8I885.pdf</a></li>
 949 | 				<li><b>Contacts query</b><br /><a href="https://github.com/kacos2000/Queries/blob/master/contacts2.sql">https://github.com/kacos2000/Queries/blob/master/contacts2.sql</a></li>
 950 | 				<li><b>Contacts calls query</b><br /><a href="https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql">https://github.com/kacos2000/Queries/blob/master/contacts2calls.sql</a></li>
 951 | 				<li><b>Learning Android Forensics - Second Edition</b><br /><a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li>
 952 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 953 | 				<li><b>Investigating Android Contacts</b><br /><a href="https://forensafe.com/blogs/Android_Contacts.html">https://forensafe.com/blogs/Android_Contacts.html</a></li>				
 954 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 955 | 				<li><b>Practical Mobile Forensics - Fourth Edition</b><br /><a href="https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520">https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520</a></li>
 956 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 957 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/contacts.py</a></li>
 958 | 			</ul>
 959 | 		<li><b>/data/com.android.providers.contacts/files/photos/</b></li>
 960 | 			<ul>
 961 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
 962 | 			</ul>
 963 | 	</ul>
 964 | </div>
 965 | 
 966 | <p>
 967 | <h3 style="text-align: left;"><b>Android Messaging Storage (com.android.providers.telephony)</b></h3>
 968 | </p>
 969 | 
 970 | <div>
 971 | 	<ul>
 972 | 		<li><b>/data/user_de/0/com.android.providers.telephony/databases/mmssms.db</b><br /><b>/data/com.android.providers.telephony/databases/mmssms.db</b></li>
 973 | 			<ul>
 974 | 				<li><b>Android Messaging Forensics – SMS/MMS and Beyond</b><br /><a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li>
 975 | 				<li><b>Android mmssms.db each table introduction</b><br /><a href="https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2">https://blog.katastros.com/a?ID=00250-640c0b9b-4c94-4928-9250-7406735e59a2</a></li>
 976 | 				<li><b>Part 1: Walk-Through of Answers to the 2021 CTF – Investigating Heisenberg’s Android Device</b><br /><a href="https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/">https://cellebrite.com/en/part-1-walk-through-of-answers-to-the-2021-ctf-investigating-heisenbergs-android-device/</a></li>
 977 | 				<li><b>Cellebrite CTF 2022 - Heisenberg's Android</b><br /><a href="https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html">https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-heisenbergs-android.html</a></li>
 978 | 				<li><b>Investigating Android SMS</b><br /><a href="https://forensafe.com/blogs/AndroidSMS.html">https://forensafe.com/blogs/AndroidSMS.html</a></li>				
 979 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
 980 | 				<li><b>Has the user ever used the XYZ application? aka traces of application execution on mobile devices<br /></b><a href="https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html">https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html</a></li>
 981 | 				<li><b>How to Uncover Application Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-application-artifacts-for-mobile-device-investigations/</a></li>
 982 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>				
 983 | 				<li><b>Learning Android Forensics - Second Edition</b><br /><a href="https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017">https://www.packtpub.com/product/learning-android-forensics-second-edition/9781789131017</a></li>
 984 | 				<li><b>Practical Mobile Forensics - Fourth Edition</b><br /><a href="https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520">https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520</a></li>
 985 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 986 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smsmms.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smsmms.py</a></li>
 987 | 			</ul>
 988 | 		<li><b>/data/com.android.providers.telephony/databases/app_parts/</b></li>
 989 | 			<ul>
 990 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
 991 | 			</ul>
 992 | 	</ul>
 993 | </div>
 994 | 
 995 | <p>
 996 | <h3 style="text-align: left;"><b>Android Calendar Storage (com.android.providers.calendar)</b></h3>
 997 | </p>
 998 | 
 999 | <div>
1000 | 	<ul>
1001 | 		<li><b>/data/com.android.providers.calendar/databases/calendar.db</b></li>
1002 | 			<ul>
1003 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
1004 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2017</b><br /><a href="https://cts-forensics.com/reports/37550_Web.pdf">https://cts-forensics.com/reports/37550_Web.pdf</a></li>
1005 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
1006 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2019</b><br /><a href="https://cts-forensics.com/reports/19-5550_Web.pdf">https://cts-forensics.com/reports/19-5550_Web.pdf</a></li>
1007 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2020</b><br /><a href="https://cts-forensics.com/reports/20-5550_Web.pdf">https://cts-forensics.com/reports/20-5550_Web.pdf</a></li>
1008 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
1009 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
1010 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
1011 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 1)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android.html</a></li>
1012 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleCalendar.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleCalendar.py</a></li>
1013 | 			</ul>
1014 | 		<li><b>/data/data/com.google.android.calendar/databases/cal_v2a</b></li>
1015 | 			<ul>
1016 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
1017 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2022<br /></b><a href="https://cts-forensics.com/reports/22-5550_Web.pdf">https://cts-forensics.com/reports/22-5550_Web.pdf</a></li>
1018 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleCalendar.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleCalendar.py</a></li>
1019 | 			</ul>
1020 | 	</ul>
1021 | </div>
1022 | 
1023 | <p>
1024 | <h3 style="text-align: left;"><b>Android Download Provider (com.android.providers.downloads)</b></h3>
1025 | </p>
1026 | 
1027 | <div>
1028 | 	<ul>
1029 | 		<li><b>/data/com.android.providers.downloads/databases/downloads.db</b></li>
1030 | 			<ul>
1031 | 				<li><b>Investigating Android Downloads</b><br /><a href="https://forensafe.com/blogs/Android_Downloads.html">https://forensafe.com/blogs/Android_Downloads.html</a></li>
1032 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
1033 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2016</b><br /><a href="https://cts-forensics.com/reports/36550_Web.pdf">https://cts-forensics.com/reports/36550_Web.pdf</a></li>
1034 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
1035 | 				<li><b>spy vs. spy: examining spyware on mobile devices</b><br /><a href="https://media.defcon.org/DEF%20CON%2020/DEF%20CON%2020%20presentations/DEF%20CON%2020%20-%20Robinson-Spy-vs-Spy.pdf">https://media.defcon.org/DEF%20CON%2020/DEF%20CON%2020%20presentations/DEF%20CON%2020%20-%20Robinson-Spy-vs-Spy.pdf</a></li>
1036 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/downloads.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/downloads.py</a></li>
1037 | 			</ul>
1038 | 	</ul>
1039 | </div>
1040 | 
1041 | <p>
1042 | <h3 style="text-align: left;"><b>Android Media Storage</b></h3>
1043 | </p>
1044 | 
1045 | <div>
1046 | 	<ul>
1047 | 		<li><b>/data/com.google.android.providers.media.module/databases/external.db</b></li>
1048 | 			<ul>
1049 | 				<li><b>Android’s external.db – Everything Old Is New Again<br /></b><a href="https://thebinaryhick.blog/2020/10/19/androids-external-db-everything-old-is-new-again/">https://thebinaryhick.blog/2020/10/19/androids-external-db-everything-old-is-new-again/</a></li>
1050 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>								
1051 | 				<li><b>Investigating Android Scoped Storage</b><br /><a href="https://forensafe.com/blogs/AndroidScopedStorage.html">https://forensafe.com/blogs/AndroidScopedStorage.html</a></li>				
1052 | 				<li><b>How to Uncover Media Artifacts for Mobile Device Investigations</b><br /><a href="https://www.magnetforensics.com/blog/how-to-uncover-media-artifacts-for-mobile-device-investigations/">https://www.magnetforensics.com/blog/how-to-uncover-media-artifacts-for-mobile-device-investigations/</a></li>				
1053 | 				<li><b>The Role of external.db in Android Forensics</b><br /><a href="https://findingtrouble.medium.com/the-role-of-external-db-in-android-forensics-53087f048864">https://findingtrouble.medium.com/the-role-of-external-db-in-android-forensics-53087f048864</a></li>				
1054 | 				<li><b>Magnet User Summit 2023 CTF - Android (Part 2)</b><br /><a href="https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html">https://www.stark4n6.com/2023/05/magnet-user-summit-2023-ctf-android_5.html</a></li>				
1055 | 				<li><b>Mobile Forensic Investigations A Guide to Evidence Collection, Analysis, and Presentation - Second Edition</b><br /><a href="https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/">https://www.oreilly.com/library/view/mobile-forensic-investigations/9781260135107/</a></li>
1056 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/emulatedSmeta.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/emulatedSmeta.py</a></li>
1057 | 			</ul>
1058 | 	</ul>
1059 | </div>
1060 | 
1061 | <p>
1062 | <h3 style="text-align: left;"><b>Android Logs Provider (com.sec.android.provider.logsprovider)</b></h3>
1063 | </p>
1064 | 
1065 | <div>
1066 | 	<ul>
1067 | 		<li><b>/data/com.sec.android.provider.logsprovider/databases/logs.db</b></li>
1068 | 			<ul>
1069 | 				<li><b>Android Messaging Forensics – SMS/MMS and Beyond</b><br /><a href="https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/">https://www.magnetforensics.com/blog/android-messaging-forensics-sms-mms-and-beyond/</a></li>
1070 | 				<li><b>Logs provider query</b><br /><a href="https://github.com/kacos2000/Queries/blob/master/logs_db.sql">https://github.com/kacos2000/Queries/blob/master/logs_db.sql</a></li>
1071 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2015</b><br /><a href="https://cts-forensics.com/reports/35550_Web.pdf">https://cts-forensics.com/reports/35550_Web.pdf</a></li>
1072 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2018</b><br /><a href="https://cts-forensics.com/reports/38550_Web.pdf">https://cts-forensics.com/reports/38550_Web.pdf</a></li>
1073 | 				<li><b>aLEAPP Plugin</b><br /><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllogs.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/calllogs.py</a></li>
1074 | 			</ul>
1075 | 	</ul>
1076 | </div>
1077 | 
1078 | <p>
1079 | <h3 style="text-align: left;"><b>Android Location (com.google.android.location)</b></h3>
1080 | </p>
1081 | 
1082 | <div>
1083 | 	<ul>
1084 | 		<li><b>/data/com.google.android.location</b><b>/files/cache.cell/cache.wifi<br />/data/com.google.android.location/files/cache.cell/cache.cell</b></li>
1085 | 			<ul>
1086 | 				<li><b>Decoding cache.cell and cache.wifi files<br /></b><a href="https://forensics.spreitzenbarth.de/2011/10/28/decoding-cache-cell-and-cache-wifi-files/">https://forensics.spreitzenbarth.de/2011/10/28/decoding-cache-cell-and-cache-wifi-files/</a></li>
1087 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/cachelocation.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/cachelocation.py</a></li>
1088 | 			</ul>
1089 | 	</ul>
1090 | </div>
1091 | 
1092 | <p>
1093 | <h3 style="text-align: left;"><b>Android Auto (com.google.android.projection.gearhead)</b></h3>
1094 | </p>
1095 | 
1096 | <div>
1097 | 	<ul>
1098 | 		<li><b>/data/com.google.android.projection.gearhead/databases/carservicedata.db</b></li>
1099 | 			<ul>
1100 | 				<li><b>How Android Bluetooth Connections Can Determine If The Hands of a Driver Were On The Wheel During An Accident</b><br /><a href="https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/">https://cellebrite.com/en/how-android-bluetooth-connections-can-determine-if-the-hands-of-a-driver-were-on-the-wheel-during-an-accident/</a><br /><a href="https://dfir.pubpub.org/pub/6ysxvhvc/release/1">https://dfir.pubpub.org/pub/6ysxvhvc/release/1</a></li>
1101 | 				<li><b>Auto-Parser: Android Auto and Apple CarPlay Forensics<br /></b><a href="https://www.researchgate.net/publication/360577665_Auto-Parser_Android_Auto_and_Apple_CarPlay_Forensics_Auto-Parser_Android_Auto_and_Apple_CarPlay_Forensics">https://www.researchgate.net/publication/360577665_Auto-Parser_Android_Auto_and_Apple_CarPlay_Forensics_Auto-Parser_Android_Auto_and_Apple_CarPlay_Forensics</a></li>
1102 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/androidauto.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/androidauto.py</a></li>
1103 | 			</ul>
1104 | 	</ul>
1105 | </div>
1106 | 
1107 | <p>
1108 | <h3 style="text-align: left;"><b>GBoard Google Keyboard (com.google.android.inputmethod.latin)</b></h3>
1109 | </p>
1110 | 
1111 | <div>
1112 | 	<ul>
1113 | 		<li><b>/data/com.google.android.inputmethod.latin/databases/trainingcache*.db</b></li>
1114 | 			<ul>
1115 | 				<li><b>Gboard has some interesting data..</b><br /><a href="<a href="https://www.swiftforensics.com/2021/01/gboard-has-some-interesting-data.html">https://www.swiftforensics.com/2021/01/gboard-has-some-interesting-data.html</a></li>
1116 | 				<li><b>Investigating Android Gboard<br /></b><a href="https://forensafe.com/blogs/AndroidGBoard.html">https://forensafe.com/blogs/AndroidGBoard.html</a></li>
1117 | 				<li><b>OMGboard<br /></b><a href="https://kibaffo33.data.blog/2022/06/05/omgboard/">https://kibaffo33.data.blog/2022/06/05/omgboard/</a></li>				
1118 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py</a></li>
1119 | 			</ul>
1120 | 	</ul>
1121 | 	<ul>
1122 | 		<li><b>/data/com.google.android.inputmethod.latin/databases/gboard_clipboard.db</b></li>
1123 | 			<ul>
1124 | 				<li><b>Gboard and Clipboard History</b><br /><a href="<a href="https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html">https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html</a></li>
1125 | 				<li><b>Investigating Android Gboard<br /></b><a href="https://forensafe.com/blogs/AndroidGBoard.html">https://forensafe.com/blogs/AndroidGBoard.html</a></li>
1126 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py</a></li>
1127 | 			</ul>
1128 | 		<li><b>/data/com.google.android.inputmethod.latin/files/clipboard_image/</b></li>
1129 | 			<ul>
1130 | 				<li><b>Gboard and Clipboard History</b><br /><a href="<a href="https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html">https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html</a></li>
1131 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/gboard.py</a></li>
1132 | 			</ul>
1133 | 	</ul>
1134 | </div>
1135 | 
1136 | <p>
1137 | <h3 style="text-align: left;"><b>Google Meet (com.google.android.apps.tachyon)</b></h3>
1138 | </p>
1139 | 
1140 | <div>
1141 | 	<ul>
1142 | 		<li><b>/data/com.google.android.apps.tachyon/databases/tachyon.db</b></li>
1143 | 			<ul>
1144 | 				<li><b>Google Duo - Android & iOS Forensic Analysis</b><br /><a href="https://www.stark4n6.com/2021/08/google-duo-android-ios-forensic-analysis.html">https://www.stark4n6.com/2021/08/google-duo-android-ios-forensic-analysis.html</a></li>
1145 | 				<li><b>Investigating Android Google Meet<br /></b><a href="https://www.forensafe.com/blogs/android-google-meet.html">https://www.forensafe.com/blogs/android-google-meet.html</a></li>
1146 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
1147 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleDuo.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleDuo.py</a></li>
1148 | 			</ul>
1149 | 	</ul>
1150 | </div>
1151 | 
1152 | <p>
1153 | <h3 style="text-align: left;"><b>Google Keep - Notes and lists (com.google.android.apps.tachyon)</b></h3>
1154 | </p>
1155 | 
1156 | <div>
1157 | 	<ul>
1158 | 		<li><b>/data/com.google.android.keep/databases/keep.db</b></li>
1159 | 			<ul>
1160 | 				<li><b>Google Duo - Android & iOS Forensic Analysis</b><br /><a href="https://www.stark4n6.com/2021/08/google-duo-android-ios-forensic-analysis.html">https://www.stark4n6.com/2021/08/google-duo-android-ios-forensic-analysis.html</a></li>
1161 | 				<li><b>Investigating Android Google Keep<br /></b><a href="https://www.forensafe.com/blogs/AndroidGoogleKeep.html">https://www.forensafe.com/blogs/AndroidGoogleKeep.html</a></li>
1162 | 				<li><b>Google Keep - Notes and Lists: Mobile Artifacts<br /></b><a href="https://blog.bi0s.in/2021/06/18/Forensics/Google-Keep-Notes-and-Lists-Mobile-Artifacts/">https://blog.bi0s.in/2021/06/18/Forensics/Google-Keep-Notes-and-Lists-Mobile-Artifacts/</a></li>
1163 | 				<li><b>Google Keep - Notes and Lists: Mobile Artifacts<br /></b><a href="https://g4rud4.gitlab.io/2021/Google-Keep-Notes-and-Lists-Mobile-Artifacts/">https://g4rud4.gitlab.io/2021/Google-Keep-Notes-and-Lists-Mobile-Artifacts/</a></li>
1164 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
1165 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021<br /></b><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
1166 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
1167 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleKeepNotes.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleKeepNotes.py</a></li>
1168 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/keepNotes.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/keepNotes.py</a></li>
1169 | 			</ul>
1170 | 	</ul>
1171 | </div>
1172 | 
1173 | <p>
1174 | <h3 style="text-align: left;"><b>Google Tasks (com.google.android.apps.tasks)</b></h3>
1175 | </p>
1176 | 
1177 | <div>
1178 | 	<ul>
1179 | 		<li><b>/data/com.google.android.apps.tasks/files/tasks-*/data.db</b></li>
1180 | 			<ul>
1181 | 				<li><b>Google Tasks - Android Forensics analysis</b><br /><a href="https://g4rud4.gitlab.io/2021/Google-Tasks-Android-Forensics-analysis/">https://g4rud4.gitlab.io/2021/Google-Tasks-Android-Forensics-analysis/</a></li>
1182 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleTasks.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleTasks.py</a></li>				
1183 | 			</ul>
1184 | 	</ul>
1185 | </div>
1186 | 
1187 | <p>
1188 | <h3 style="text-align: left;"><b>Google Maps (com.google.android.apps.maps)</b></h3>
1189 | </p>
1190 | 
1191 | <div>
1192 | 	<ul>
1193 | 		<li><b>/data/com.google.android.apps.maps/app_tts-cache/</b></li>
1194 | 			<ul>				
1195 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>
1196 | 				<li><b>At the roundabout, take the second exit…<br /></b><a href="https://kibaffo33.data.blog/2021/12/30/at-the-roundabout-take-the-second-exit/">https://kibaffo33.data.blog/2021/12/30/at-the-roundabout-take-the-second-exit/</a></li>
1197 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlemapaudio.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlemapaudio.py</a></li>				
1198 | 			</ul>			
1199 | 		<li><b>/data/com.google.android.apps.maps/app_tts-temp/</b></li>
1200 | 			<ul>				
1201 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>
1202 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlemapaudioTemp.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlemapaudioTemp.py</a></li>				
1203 | 			</ul>
1204 | 		<li><b>/data/com.google.android.apps.maps/databases/gmm_myplaces.db</b></li>
1205 | 			<ul>				
1206 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>
1207 | 				<li><b>Decoding Android Google Maps : gmm_myplaces.db<br /></b><a href="https://segumarc.com/2023/12/15/decoding-android-google-maps-gmm_myplaces-db/">https://segumarc.com/2023/12/15/decoding-android-google-maps-gmm_myplaces-db/</a></li>
1208 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2023<br /></b><a href="https://cts-forensics.com/reports/23-5550_Web.pdf">https://cts-forensics.com/reports/23-5550_Web.pdf</a></li>
1209 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
1210 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py</a></li>				
1211 | 			</ul>			
1212 | 		<li><b>/data/com.google.android.apps.maps/databases/gmm_storage.db</b></li>
1213 | 			<ul>				
1214 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>
1215 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
1216 | 				<li><b>Magnet Virtual Summit 2024 CTF - Android</b><br /><a href="https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html">https://www.stark4n6.com/2024/03/magnet-virtual-summit-2024-ctf-android.html</a></li>
1217 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py</a></li>				
1218 | 			</ul>		
1219 | 		<li><b>/data/com.google.android.apps.maps/databases/gmm_sync.db</b></li>
1220 | 			<ul>				
1221 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>				
1222 | 				<li><b>Investigating Android Google Maps</b><br /><a href="https://forensafe.com/blogs/Android-GoogleMaps.html">https://forensafe.com/blogs/Android-GoogleMaps.html</a></li>
1223 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsGmm.py</a></li>				
1224 | 			</ul>		
1225 | 		<li><b>/data/com.google.android.apps.maps/files/new_recent_history_cache_search.cs</b></li>
1226 | 			<ul>				
1227 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>
1228 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2024<br /></b><a href="https://cts-forensics.com/reports/24-5550_Web.pdf">https://cts-forensics.com/reports/24-5550_Web.pdf</a></li>
1229 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsSearches.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleMapsSearches.py</a></li>				
1230 | 			</ul>			
1231 | 		<li><b>/data/com.google.android.apps.maps/files/saved_directions.data.cs</b></li>
1232 | 			<ul>				
1233 | 				<li><b>Finding Phones With Google Maps Part 1 (Android)<br /></b><a href="https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/">https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/</a></li>
1234 | 				<li><b>Collaborative Testing Services - Mobile Digital Evidence - 2021</b><br /><a href="https://cts-forensics.com/reports/21-5550_Web.pdf">https://cts-forensics.com/reports/21-5550_Web.pdf</a></li>
1235 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleLastTrip.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googleLastTrip.py</a></li>				
1236 | 			</ul>
1237 | 	</ul>
1238 | </div>
1239 | 
1240 | <p>
1241 | <h3 style="text-align: left;"><b>Google Photos (com.google.android.apps.photos)</b></h3>
1242 | </p>
1243 | 
1244 | <div>
1245 | 	<ul>
1246 | 		<li><b>/data/com.google.android.apps.photos/databases/gphotos*.db*</b></li>
1247 | 			<ul>
1248 | 				<li><b>Investigating Android Google Photos<br /></b><a href="https://forensafe.com/blogs/AndroidGooglePhotos.html">https://forensafe.com/blogs/AndroidGooglePhotos.html</a></li>
1249 | 				<li><b>A first look at Android 14 forensics</b><br /><a href="https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html">https://blog.digital-forensics.it/2024/01/a-first-look-at-android-14-forensics.html</a></li>
1250 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlePhotos.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlePhotos.py</a></li>
1251 | 			</ul>
1252 | 		<li><b>/data/com.google.android.apps.photos/databases/disk_cache*</b></li>
1253 | 			<ul>
1254 | 				<li><b>Investigating Android Google Photos<br /></b><a href="https://forensafe.com/blogs/AndroidGooglePhotos.html">https://forensafe.com/blogs/AndroidGooglePhotos.html</a></li>
1255 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlePhotos.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/googlePhotos.py</a></li>
1256 | 			</ul>
1257 | 		<li><b>/com.google.android.apps.photos/databases/local_trash.db</b></li>
1258 | 			<ul>
1259 | 				<li><b>Dumpster Diving in Google Photos Android App: "local_trash.db"<br /></b><a href="https://deagler4n6blog.blogspot.com/2021/01/dumpster-diving-in-google-photos-android-app.html">https://deagler4n6blog.blogspot.com/2021/01/dumpster-diving-in-google-photos-android-app.html</a></li>
1260 | 				<li><b>Investigating Android Google Photos<br /></b><a href="https://forensafe.com/blogs/AndroidGooglePhotos.html">https://forensafe.com/blogs/AndroidGooglePhotos.html</a></li>
1261 | 			</ul>	
1262 | 	</ul>
1263 | </div>
1264 | 
1265 | <p>
1266 | <h3 style="text-align: left;"><b>Samsung My Files (com.sec.android.app.myfiles)</b></h3>
1267 | </p>
1268 | 
1269 | <div>
1270 | 	<ul>
1271 | 		<li><b>/data/com.sec.android.app.myfiles/databases/myfiles.db</b></li>
1272 | 			<ul>
1273 | 				<li><b>Android - Samsung My Files App<br /></b><a href="https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html">https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html</a></li>
1274 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyFiles.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyFiles.py</a></li>
1275 | 			</ul>
1276 | 		<li><b>/data/com.sec.android.app.myfiles/databases/FileInfo.db</b></li>
1277 | 			<ul>
1278 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyfilesOpHistory.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyfilesOpHistory.py</a></li>
1279 | 			</ul>
1280 | 		<li><b>/data/com.sec.android.app.myfiles/databases/FileCache.db</b></li>
1281 | 			<ul>
1282 | 				<li><b>Android - Samsung My Files App<br /></b><a href="https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html">https://abrignoni.blogspot.com/2019/06/android-samsung-my-files-app.html</a></li>
1283 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyfilesStored.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyfilesOpHistory.py</a></li>
1284 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyfilescache.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/smyfilescache.py</a></li>
1285 | 			</ul>
1286 | 	</ul>
1287 | </div>
1288 | 
1289 | <p>
1290 | <h3 style="text-align: left;"><b>Samsung Gallery (com.sec.android.gallery3d)</b></h3>
1291 | </p>
1292 | 
1293 | <div>
1294 | 	<ul>
1295 | 		<li><b>/data/com.sec.android.gallery3d/databases/local.db</b></li>
1296 | 			<ul>
1297 | 				<li><b>Mike & the Monkey Dumpster Dive Into Samsung Gallery3d App Trash<br /></b><a href="http://cheeky4n6monkey.blogspot.com/2022/01/mike-monkey-dumpster-dive-into-samsung.html">http://cheeky4n6monkey.blogspot.com/2022/01/mike-monkey-dumpster-dive-into-samsung.html</a></li>
1298 | 				<li><b>aLEAPP Plugin<br /></b><a href="https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/galleryTrash.py">https://github.com/abrignoni/ALEAPP/blob/master/scripts/artifacts/galleryTrash.py</a></li>
1299 | 			</ul>
1300 | 	</ul>
1301 | </div>
1302 | 
1303 | 


--------------------------------------------------------------------------------