Book Image

Learning Android Forensics

By : Rohit Tamma, Donnie Tindall
Book Image

Learning Android Forensics

By: Rohit Tamma, Donnie Tindall

Overview of this book

Table of Contents (15 chapters)
Learning Android Forensics
About the Authors
About the Reviewers

Wi-Fi analysis

Wi-Fi is not technically an application (as evidenced by the fact that it is not recovered from /data/data), but it is an invaluable source of data that should be examined. So, we'll briefly discuss it here. Wi-Fi connection data is found in /data/misc/wifi/wpa_supplicant.conf. The wpa_supplicant.conf file contains a list of access points that the user has chosen to connect to automatically (this is set by default when a new access point is connected to). Access points that the user has "forgotten" through the device settings will not be shown. If the access point requires a password, that would also be stored in the file in plain text. In the following example, the NETGEAR60 access point required a password (ancientshoe601), while hhonors did not:


The presence of a Service Set ID (SSID) in this file does NOT mean that this device connected to that access point. These settings are saved to a user's Google account and added to the device when that account is set up. An...