Other things you can do--
adb shell dumpsys wifi-- this is one of my favorites.
It is going to go through and show you
all the Wi-Fi connections the user has been connected to.
Why is this important?
Let's take a look.
Adb devices-- and I'm going to zoom in.
Adb shell dumpsys wifi--
tons of location artifacts.
All of the items that I've connected to,
even ones that are in range.
So the studio that I'm recording in, I can see that listed here.
I have not connected this device,
but it knows that I'm within range of it.
Think about stalking investigations.
I was assisting with the Delphi murders case,
and this is something that I mentioned to them.
If the person who killed those young girls had cellular
turned on, Wi-Fi turned on, Bluetooth turned on
on his device when the murder happened,
what if their device collected these types of things?
It's crazy what you can actually get,
even if you're not connected.
But in here, it will show you all the ones
that I did connect to.
Now, this is a lot of information.
So what I recommend is you actually export this to a text
file, so you could search it.
But it's nice to see what the user actually connected to,
last connections, how frequently they connected.
And it can also show user habits.
Like, you'll see I often connect to American Airlines lounge.
I connect to a lot of Hiltons and Hyatts
because that's where SANS courses run.
And that's where I do a lot of my testing research.
But it's awesome location artifacts
that you can get for free.
On the right-hand side, adb shell dumpsys user--
information about the user on that device.
It's also going to tell you if the device is managed, how
many users are enabled on it.
You may find more than one user on it.
This is typical on tablets where you
have parent and child relationships or primary user
and guests.
But some people, on their Androids,
will have work and personal.
So just make sure you're keeping an eye out for that.