Forensically analyzing an application is as much of an art as it is a science. There are myriad ways an application can store or obfuscate its data. Different versions of the same application may even store the same data differently. A developer is really only limited by their imagination (and Android platform restrictions) when it comes to choosing how to store their data. As a result of these factors, application analysis is a constantly shifting target. The methods that an examiner uses one day may be completely irrelevant the next.

The end goal of forensically analyzing an application is consistently the same, to understand what the app was used for and find user data.

In this chapter, we will look at the current version of many common applications. As apps can, and do, change how they store data through updates, nothing in this chapter is a definitive guide for how to analyze that application. Instead, we will look at a broad range of applications to show a variety...