A hands-on forensic investigation into what lives inside an Android device — contacts, messages, browsing history, app databases, cookies, and more — extracted using ADB and analysed with Autopsy on a live emulated environment.

Messages Recovered	Contacts Found	Web Cookies Logged	Installed Programs
742	312	3,122	1,570

Your Phone Remembers Everything You've Forgotten

Every message you sent, every site you visited, every app you opened — your Android device stores it all, tucked away in SQLite databases, log files, and hidden caches. Most of us never think about it. But when a crime happens, that data becomes the most important witness in the room.

This research set out to answer a practical question: how effectively can we extract and reconstruct user activity from an Android device using open-source tools alone? The investigation used Android Debug Bridge (ADB) for data acquisition and Autopsy for analysis — no expensive commercial software, just the tools any practitioner can access.

NIST Digital Forensics Investigation Process — **The Framework:** The NIST Digital Forensic Investigation Process — Acquisition, Preservation, Examination and Analysis, Documentation and Presentation. Every step of this investigation follows this model exactly.

Kaspersky mobile attack statistics — **Why Android?** Kaspersky data from Q4 2021 to Q2 2023 shows consistently ~5 million mobile attacks per quarter — making forensic capability not a niche skill but a critical one for any cybersecurity practitioner.

Building the Lab: A Virtual Android Device

Rather than working with a physical device — which introduces hardware variability and chain-of-custody complications — a controlled Android emulator was configured using Android Studio. This gave the investigation a repeatable, forensically clean environment to work from.

🔬 Why Emulation?
Emulators allow forensic methods to be tested under consistent, reproducible conditions across multiple Android versions. They're ideal for research — though real investigations always supplement with physical device testing for hardware-specific security features like Trusted Execution Environments.

Android Studio hardware selection showing Pixel 4 XL — **Step 1 — Hardware:** Google Pixel 4 selected in Android Studio. A realistic device profile at 1080x2280, 440dpi establishes the right emulation baseline.

System image selection showing Android 11 AOSP ATD — **Step 2 — OS:** Android 11 (API Level 30, AOSP ATD, x86_64) selected. A modern, widely-deployed version with current security features to test against.

With the emulator running, USB Debugging was enabled in Developer Options — a crucial prerequisite for ADB to communicate with the device. Without this flag, ADB cannot connect and no extraction is possible.

One Command. Everything the Device Will Give Up.

ADB is a command-line tool included in the Android SDK. It creates a bridge between a forensic workstation and an Android device, allowing investigators to pull data without modifying the device's state — preserving evidence integrity throughout.

The acquisition used a single backup command that pulled all app data, contacts, messages, and shared storage into a .ab archive on the forensic workstation:

PS C:\Users\kimay\AndroidStudioProjects\MyApplication> adb backup -apk -shared -all -f D:/CYBERSECURITY/Dissertation/backup.ab

ADB backup command running in PowerShell — **ADB fires:** The command runs in PowerShell. The warning confirms this is working — “Now unlock your device and confirm the backup operation...”

Android emulator Full Backup confirmation screen — **Device confirms:** The emulator's Full Backup screen appears. One tap on “Back up my data” — and everything accessible is pulled to disk.

⚠️ ADB's Hard Limit
ADB excels at logical acquisition — accessible user data, app databases, messages, browsing history. It cannot bypass full-disk encryption or access system-protected partitions without root privileges. Encrypted devices require physical acquisition methods.

Loading the Evidence. Letting Autopsy Do the Work.

With the backup extracted, it was loaded into Autopsy — an open-source digital forensics platform built on The Sleuth Kit. Autopsy parsed every file, indexed every database, and surfaced the data in an organised, searchable interface. The pipeline from raw backup to forensic insight:

ADB Backup › Autopsy Ingest › Parse DBs › Timeline › Report

The analysis covered four categories of evidence — contacts and messaging, instant messaging apps, browsing history, and system logs:

Forensic analysis four-category diagram — **The four pillars:** Contacts and Groups (contacts2.db, mmssms.db), Instant Message Applications (app-specific SQLite), Browsing History (browser stores and cookies), and Logs — event, main, and kernel.

The Contact Book Never Lies

Android stores every contact — phone-saved or SIM-saved — in a SQLite database called contacts2.db. Call history lives here too. SMS and MMS messages are in a separate file: mmssms.db. Autopsy read both without any manual extraction work.

Autopsy showing 312 contacts recovered — **312 contacts recovered:** Autopsy's Contacts panel pulls names, phone numbers, and emails from contacts2.db, imofriends.db, and naver_line — aggregating contacts across every installed messaging app automatically into a single view.

DB Browser showing contacts2.db raw data — **Raw contact data in DB Browser:** Drilling directly into contacts2.db reveals underlying token hashes, email addresses, and phone numbers. This level of detail can link device accounts to real-world identities in an investigation.

Autopsy showing 742 messages from mmssms.db — **742 messages, timestamps intact:** Every SMS stored in mmssms.db — with exact date/time, direction (incoming/outgoing), read status, and source phone number. A complete, timestamped communication log.

DB Browser showing mmssms.db with full message bodies — **Message bodies exposed:** Full message content visible — verification codes from Signal, Telegram, TikTok, WhatsApp, Snapchat, and Apple Music. Every OTP ever received is preserved in this database.

WhatsApp, TextNow, LINE, Viber — All Opened

The emulator had WhatsApp, Facebook, IMO, LINE, TextNow, and Viber installed — each storing its data in a separate app-specific SQLite database. Autopsy catalogued them all automatically under Communication Accounts.

Autopsy Communication Accounts tree listing all messaging apps — **Every app, indexed:** 212 communication accounts across Device (21), Email (6), Facebook (6), IMO (8), LINE (14), Phone (109), TextNow (32), Viber (6), WhatsApp (10). One tree, every conversation platform.

TextNow textnow_data.db in DB Browser — **TextNow — textnow_data.db:** Conversations table exposes contact values, message counts, contact names, and avatar colour codes. Every conversation partner logged.

WhatsApp msgstore.db showing dozens of message tables — **WhatsApp — msgstore.db:** Dozens of tables inside — message_text, message_thumbnail, message_vcard, messages_fts. WhatsApp's schema maps every feature it offers.

💡 The Cross-App Picture
Instant messaging databases don't just contain text — they include media metadata, delivery statuses, contact relationships, account identifiers, and timestamps. Cross-referencing these databases across apps builds a complete social graph of the device owner.

The Browser Tells the Story the User Forgot to Delete

Web history is often the most revealing forensic artefact — it shows intent, research, interests, and behaviour patterns across time. Autopsy extracted the full browsing history with URLs, page titles, and precise access timestamps.

Autopsy web history showing eBay, PayPal, NFL browsing — **Web history reconstructed:** Full browsing sessions visible — eBay searches, PayPal logins, NFL.com. The device visited eBay at 14:48:23 BST and PayPal at 14:49:31 BST — a complete timestamped record of intent.

Autopsy installed programs panel showing 1570 entries — **1,570 installed programs:** library.db contains every installed package — Chrome, GoogleCamera, Docs, Sheets, Slides, Keep. The full app footprint of the device owner, traceable to specific installs.

Autopsy web cookies showing 3122 cookies — **3,122 web cookies:** cookies.sqlite stores every tracking cookie — AMP_TOKEN, CN_visits, session_seen_posts. Even opt-out cookies are logged, proving the user's browsing identity across sessions.

Why Android Is Such Rich Forensic Territory

All this data is accessible because Android's layered architecture creates rich, structured data at every level — from the Linux Kernel up through libraries, runtime, framework, and applications.

Android architecture diagram — **Android's architecture:** Linux Kernel at the base manages hardware and memory. Libraries (SQLite, WebKit, SSL) handle data storage and networking. The Application Framework provides APIs. Applications generate the user-facing data forensics targets.

7 Essential Android Forensics Tools — **The full toolkit landscape:** Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, XRY by MSAB, ADB, Autopsy with Android plugins, and Belkasoft Evidence Center. This investigation used ADB and Autopsy — the open-source pairing that any practitioner can deploy.

What the Investigation Actually Found

01 — ADB Works — With a Ceiling

Successfully extracted all user-accessible data without altering the device. Hit a hard wall at encrypted partitions and system-protected files — logical acquisition only goes so far.

02 — Autopsy Excels at Analysis

Timeline reconstruction, file carving, keyword search, deleted file recovery — all reliable. Slower on very large datasets but consistently accurate across all analysis categories.

03 — Every App Leaves a Database

WhatsApp, TextNow, LINE, Viber, Facebook — each left a complete SQLite database. Cross-referencing them builds a social graph that reveals far more than any single app alone.

04 — Encryption Is the Real Wall

Full-disk and file-based encryption in Android 11 blocked access to the most sensitive data. Without rooting or physical acquisition methods, these partitions remain inaccessible.

🔒 The Open Problem
Modern Android encryption is genuinely robust. ADB cannot bypass it, and neither can Autopsy without pre-existing keys. Future work should explore physical acquisition pipelines, advanced decryption techniques, and AI-driven analysis tools — this is the frontier of Android forensics.