Book Image

Learning Android Forensics

By : Rohit Tamma, Donnie Tindall
Book Image

Learning Android Forensics

By: Rohit Tamma, Donnie Tindall

Overview of this book

Table of Contents (15 chapters)
Learning Android Forensics
About the Authors
About the Reviewers

Google Plus analysis

Google Plus is the Google-based social network. It allows us to share text/videos/images, add friends, follow people, and message. Google Plus may also, depending on the user's settings, automatically upload all pictures taken on the user's device.

Package name:


Files of interest:

  • /databases/es0.db

The Es0.db database contains all the information an examiner would expect to find from a social-media account:




This contains a URL to download images shared by and with the user as well as the creation date/time in the Linux epoch format.


This contains data displayed in the user's stream (that is, their news feed). The created and modified time for each post is, once again, stored in the Linux epoch time. The title and comment columns will contain the post title and at least some of the comments from it. The permalink column contains a URL that can be followed to view the post...