So now, we know possibly some hints
on where the person was when a crime occurred
or to confirm that they weren't at the scene of the crime.
We have Google Cloud data.
We have Google Maps.
We haven't talked about third-party applications
and app tracking from that perspective.
That's for Section 5.
We have-- let's see, what else?
WeatherClock, turbo.db, all those other databases
that are tracking it.
We have the databases you can trust-- the dme.db,
the iwc text dump.
So all of these things are going to help you
put the person at the location.
But now, can we say it happened on that device?
What if it's syncing from somewhere else?
So one of the first things you would want to look at
is checkin.xml.
Checkin.xml is a shared preference
file that, what it does is periodically, or upon phone
reboot, it is going to check to make
sure your SIM card is inserted, that you have a proper data
plan.
So think about this.
You go to initiate a call.
It needs to know, are you on Wi-Fi?
Do you have Wi-Fi calling enabled?
Do you need to use your SIM card?
Do you have a data plan?
It's going to check.
So it's going to check, and you will see that lastSim.
So we have the ICC ID, which is the serial number of the SIM
card, and we have the IMSI, the I-M-S-I for that SIM card.
We will also see account information.
We see howieday11 again there.
You will have date/time stamps as well.
Under com.google.andro id.gms.databases,
there is a plethora of files of interest for you.
Leverage your cheat sheet, but don't be afraid to dive
into unknown files and test and validate them.
We're going to look at networkUsage.db.
Table of interest is network_raw_entry.
This is exactly what it sounds like.
What is the network that is being used?
Is it Wi-Fi?
Is it cellular?
How many bytes?
What is actually occurring?
Ns.db-- pending operations-- now, this one's really cool.
This is the file that I believe tracks garbage collection.
So in order to keyword search for garbage collection, what
I like to do is I like to search for clean, let's
see, wipe, flush.
Those are typically nice words to search for.
This sounds gross, but think of bathroom terminology.
And that will help you with ns.db.
We're going to look at Herrevad.
Herrevad has tables of interest local_reports and lru.
We have WifiConfigStore.xml in two different locations,
so make sure you look at this.
We have it initially under misc/wifi/WifiConfigStore.xml
and also under apexdata/com/and roid.wifi/WifiConfigStore.xml.
It depends on the Android version on where it's stored.
Where you have to be careful is, what if that person updated?
Could be in both locations.
What's really wild is that these two
files right here, the WifiConfigStore, they track
Wi-Fi that is not in Herrevad.
Again, not sure what forces data in one or the other.
Just be aware that they exist.
And then, we have two additional locations for the softap.conf.
Depending on the version of Android,
it may be in app or apexdata/com/android.wifi.
Make sure you know these paths.
Make sure you know these versions.
These are also on your cheat sheets.