The files here are stored in the internal storage. These are located typically in the application's /data/data subdirectory. Data stored here is private and cannot be accessed by other applications. Even the device owner is prevented from viewing the files (unless they have root access).

However, based on the requirement, the developer can allow other processes to modify and update these files. The following screenshot shows the details of the apps stored with their package name under the /data/data directory:

The internal data of each app is stored in their respective folders. For instance, the following screenshot shows internal storage that belongs to the YouTube app on an Android device:

Usually the databases, lib, shared_pref, cache folders are created for most of the applications. The following table provides a brief description of these folders:

Folders other than these are custom folders created by the app developer. The databases folder is the one that contains crucial data that helps in forensic investigations. As shown in the following screenshot, data in this folder is stored in SQLite files:

This data can be viewed using tools such as DB Browser for SQLite. More details about how to extract data is covered in detail under Chapter 4, Extracting Data Logically from Android Devices.