Android devices store lots of sensitive data through the use of apps. Although we have earlier categorized apps as system and user-installed apps, here is a more detailed split:
- Apps that come along with Android
- Apps installed by the manufacturer
- Apps installed by the wireless carrier
- Apps installed by the user
All of these store different types of data on the device. Application data often contains a wealth of information that is relevant to the investigation. Here is a sample list of possible data that can be found on an Android device:
- SMS
- MMS
- Chat messages
- Backups
- Emails
- Call logs
- Contacts
- Pictures
- Videos
- Browser history
- GPS data
- Files or documents downloaded
- Data that belongs to installed apps (Facebook, Twitter, and other social media apps)
- Calendar appointments
Data belonging to different applications can be stored either internally or externally. In the case of external storage (SD card), data can be stored in any location. But in the case of internal storage, the location is predefined. To be specific, the internal data of all apps present on the device (either system apps or user-installed apps) is automatically saved in a subdirectory of /data/data named after the package name. For example, the default Android email app has a package name of com.android.email and the internal data is stored in /data/data/com.android.email. We are going to discuss this in detail in the coming sections but, for now, this knowledge is sufficient to understand the following details.
Android provides developers with certain options to store data to the device. The option that can be used depends on the underlying data that is to be stored. Data that belongs to applications can be stored in one of the following locations:
- Shared preferences
- Internal storage
- External storage
- SQLite database
- Network
The following sections provide clear explanations regarding each of these options.