Now, let's start with the contacts,
the call logs, the SMS.
I have to warn you, Android's a little bit of a nightmare
because, depending if it's Samsung or not,
data could be stored in multiple places.
There are some consistencies, but Samsung always
has additional locations, it seems.
So the first thing we want to do is
we want to go to com.android.providers.contacts.
And within databases, we're going
to find a file called contacts2.db.
Your tables of interest--
we have contacts, data, deleted_contacts,
and raw_contacts.
And this is where you're like, what in the heck?
Why are there so many?
I don't know why.
Welcome to Android.
You will find that contacts could be
how you store your information.
So think about this.
If you have an Android and you enter a contact,
you may be prompted with, do you want to save this to the SIM?
Do you want to save it to the device?
Do you want to save it to Google?
Your choice is going to make a difference on where
that information is stored.
Something else that could exist there--
under raw_contacts, I've seen a lot of third-party applications
that are storing contacts there.
If you're worried about third-party apps that
have access to your contacts, look at the table
called accounts.
It will tell you which ones have access to it.
Now, if you have contacts2.db, you're like, great.
I have all the contacts.
You do now.
What about third-party applications
that store contacts?
What about the contacts that exist in cloud?
There could always be more.
What about contacts that exist on the SIM card?
So if you've acquired that SIM card,
if you're willing to hunt for contacts and apps,
you could run the fuzzy model plugin in Cellebrite,
and that pulls contacts from applications
that are not parsed.
It's a great starting point.
If your device is rooted or you have physical access to it,
you will see icing_contacts.db.
Now, anything that sounds sweet from this point forward--
icing, frosting-- what I want you to remember in your head
is you need physical access to that, which means you typically
have a root.
So icing db, this file right here,
is an exact copy of contacts2.db.
I honestly don't know why it exists,
but you will find that it does.
I also don't know, if the user deletes contacts
from contacts2, how long it will take for icing_contacts
to sync.
So you may find some differences there.
You may get lucky.
Google Plus is a thing of the past.
However, if the user used it, you will find that under
com.google.andro id.gms/databases
/icing_contacts.db.