Book Image

Learning Android Forensics

By : Rohit Tamma, Donnie Tindall
Book Image

Learning Android Forensics

By: Rohit Tamma, Donnie Tindall

Overview of this book

Table of Contents (15 chapters)
Learning Android Forensics
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Google Plus analysis


Google Plus is the Google-based social network. It allows us to share text/videos/images, add friends, follow people, and message. Google Plus may also, depending on the user's settings, automatically upload all pictures taken on the user's device.

Package name: com.google.android.apps.plus

Version: 4.8.0.81189390

Files of interest:

  • /databases/es0.db

The Es0.db database contains all the information an examiner would expect to find from a social-media account:

Table

Description

all_photos

This contains a URL to download images shared by and with the user as well as the creation date/time in the Linux epoch format.

activites

This contains data displayed in the user's stream (that is, their news feed). The created and modified time for each post is, once again, stored in the Linux epoch time. The title and comment columns will contain the post title and at least some of the comments from it. The permalink column contains a URL that can be followed to view the post...