Android logcat is also sometimes useful during forensic investigations. It contains the logs of all the activities carried out on the phone as well as the radio devices. Though not complete, it will help the investigator to get an idea of what has been going on in the device.

To capture and save the logcat dump, we could simply use adb logcat and save the output to a file, which we could analyze later on.

adb logcat > logcat_dump.log

We could also use logcat to get the logs in a much more detailed and useful manner. For example, we could get the radio logs by specifying radio along with the -b parameter. The -b flag is used to display the logcat of a buffer (such as radio or event). The -v flag is used to control the output format which is verbose and could be either time, brief, process, tag, raw, threadtime, or long. Instead of –v, we could also use -d (debug), -i (information), -w (warning), or -e (error).

adb logcat -v time -b radio -d 

We could also use other utilities...