This chapter will cover application analysis. This chapter will focus on analyzing the data that would be recovered using any of the logical or physical techniques detailed in Chapter 4, Extracting Data Logically from Android Devices, and Chapter 5,  Extracting Data Physically from Android Devices. It will also rely heavily on the storage methods discussed in Chapter 2, Setting Up the Android Forensic Environment; we will see numerous SQLite databases, XML files, and other file types from various locations within the file hierarchy described in that chapter. By the end of this chapter, the reader should be familiar with the following:

• Application analysis overview
• Why do app analysis?
• Third-party applications and various methods used by popular applications to store and obfuscate data