Application data-- as a reminder from Section 1
when we talked about where you're
going to find these databases-- on Android,
every single application is going
to be stored under USERDATA/data.
You're going to have an application folder that
is named whatever that Android or application wants
to call it.
Usually, it's com.android, whatever, or com.sec--
because it's secure-- android and so on, com.google,
com.samsung.
You're going to find that.
Where I recommend you start is databases.
Go there and sort by size.
Look at things that are used.
Quickly scan through them.
If databases are encrypted-- and this is common
with Android-- or if they're not extracted,
depending on your level of extraction, go to cache.
Remember earlier in the section when
I said cache, as a partition, seems to be empty,
and I don't know if it's because of garbage collection?
Every single application has a cache directory now.
I always look at shared preferences
to see if I can get usernames, potentially
passwords that aren't PIN certificates or secure.
But that's typically where you're going to focus.
Lib and Files, you can check it.
But chances are, you're not going
to be doing a lot of forensic analysis in those locations.