User accounts-- so let's start at the top.
You have two locations, system device encrypted or system
credential encrypted.
Depending on how the user has it set up with direct boot or not,
you may have items in both.
0 means primary user.
And we can see accounts_de.db and accounts_ce.db.
Make sure you examine both of these.
Accounts.db, just under data/system,
used to exist on older Android devices.
These are the three key locations
that you are going to find user accounts.
Obviously, you could have third-party applications
where it's not relied upon in these databases.
But this is typically where you're going to find those.
The tools are going to parse it slightly differently.
So in that screenshot on the left,
we could see Physical Analyzer.
It shows you the name, the account, and user key.
If there's an email address, if there's an ID,
all of those items are listed there.
Under Details here, this is Axiom,
and you can see that it shows the password or token
and the app for what you choose and the username.
Now, what if there is a backup account?
And I want you to think about this.
Why do you care if there is a backup account?
So if you go to BackupAccount.xml,
you have to look at the email address that's stored there.
You have to compare that to the primary account that's
in accounts_de or ce.db.
If they are the same, that means there is no backup account
for that device.
However, let's say, you're examining this one, right here.
And we can see the primary account
is rachwhite1117@gmail.com.
And then you go to backup account,
and you see howieday1117@gmail.com.
What this means, there are now two repositories
of at least 15 gigs in size for Google backups
for this device, howieday and Rachel White.
In addition, if you're doing covert operations,
if the user is alerted to anything-- like,
you can be alerted when your phone reboots.
You could be alerted when someone enters a passcode.
Anything that the user is going to be alerted to
will go to both of those locations.
So if you're doing covert operations,
be very, very careful.