Digging even deeper-- in user data, when an Android
application is installed, you will
find that there is going to be a trace
in the dalvik-cache directory.
Now, this depends on the type of application
and the OS on the Android.
You could have DEX files, which are Dalvik executables.
You could have OAT, which actually
stands for Ahead Of Time, so I don't know why it's not AOT.
And then Android Runtime, ART files.
When an app is deleted, these may still persist.
In addition to that, you'll have profiles
which will include metadata for each of these installed apps.
Under USERDATA/system-- this is not the system partition,
this is that system directory within the USERDATA data--
you will find packages.xml and packages.list.
This is going to tell you where the app was installed
and any permissions it had.
Ultimately, library.db, putting the who behind it.
Which Google account is responsible for when
that application was installed?