Book Image

Learning Android Forensics

By : Rohit Tamma, Donnie Tindall
Book Image

Learning Android Forensics

By: Rohit Tamma, Donnie Tindall

Overview of this book

Table of Contents (15 chapters)
Learning Android Forensics
About the Authors
About the Reviewers

Contacts/call analysis

Contacts and call logs are stored in the same database. Contacts do not have to be added explicitly by the user. They may be autofilled when an e-mail is sent through Gmail, or a person is added on Google+, or possibly many other ways.

Package name:

Version: Default version with Android 5.0.1 (not listed within app)

Files of interest:

  • /files/

    • photos/

    • profile/

  • /databases/

    • contacts2.db

The files directory contains photos for the user's contacts in the photos directory and the user's profile photo in the profile directory.

The contacts2.db database contains all of the information about calls made to and from the device and all contacts in the user's Google account. It contains the following tables:




This shows the accounts on the device that have access to the contacts list. At least one of the accounts will show the user's Google account e-mail address. This list may include third-party apps installed that...