Now that we have seen a lot of tools to aid us while performing forensics, we could also use adb and our manual skills to extract some of the information from the device. As we learned earlier, the application files are stored at /data/data/[application's package name]/. Since most of the applications also use databases to store the data, we will notice that there is another folder named databases inside the package named directory. One thing to note here is that this will only help us extract the information from the applications that use databases in order to store applications and other related information. In some of the applications, we might also notice that the application is storing data in an XML file or using shared preferences, which we need to manually review.

Android uses the SQLite database (which we'll be covering in depth in the next chapter) with the file format of the files .db. Here is how we could go ahead and extract all the databases...