Cyber Security Academy · Lesson

Android Acquisition and Analysis

Extracting and analyzing Android data.

Android Acquisition and Analysis is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Android Storage Architecture

To extract Android data effectively, you must know where it lives.

/data/data/<package>/ — each app sandbox: databases, shared_prefs, files, cache.
/data/media/0/ — user storage (photos, downloads).
/data/system/ — accounts, lock settings, usage stats.

Most app evidence sits in SQLite databases and XML preference files inside the per-app sandbox, which is unreadable without root or a backup mechanism.

ADB and Debugging Prerequisites

The Android Debug Bridge (ADB) is the primary logical-acquisition channel. It requires USB debugging to be enabled and the host key authorized.

Without debugging enabled and the screen unlocked, ADB access is blocked.
The authorization prompt itself alters device state — document it.

Verify connectivity and capture device properties first:

adb devices -l
adb shell getprop ro.build.version.release   # Android version
adb shell getprop ro.product.model           # Device model
adb shell getprop ro.crypto.state            # encrypted / unencrypted

Logical Acquisition via ADB Backup

adb backup produces an .ab archive of app data that allows backup. It is non-root and widely available but limited: many apps set allowBackup=false.

Captures app data, APKs (with -apk), and shared storage.
Misses apps that opt out, and deleted records.

Create and convert a backup for analysis:

# Create a full backup (user must confirm on device)
adb backup -apk -shared -all -f android_backup.ab

# Convert the .ab to a readable tar (android-backup-extractor)
java -jar abe.jar unpack android_backup.ab android_backup.tar
tar -xvf android_backup.tar

File System Extraction

A file-system extraction copies the directory tree, including app sandboxes and SQLite WAL/SHM journal files that hold unsynced records.

Requires root, a forensic agent, or an exploit/bootloader method.
Preserves -wal and -shm files — critical, as recent rows may exist only there.

When pulling SQLite databases, always grab the journal companions too:

adb pull /data/data/com.whatsapp/databases/msgstore.db ./out/
adb pull /data/data/com.whatsapp/databases/msgstore.db-wal ./out/
adb pull /data/data/com.whatsapp/databases/msgstore.db-shm ./out/

Physical Acquisition Realities

A physical image is a bit-for-bit copy of the NAND, including unallocated space where deleted data may persist. On modern Android it is the hardest to obtain.

FBE encryption means a raw NAND dump is ciphertext without the user key.
Methods include vendor exploits, EDL/bootloader modes, or chip-off (last resort, destructive).
Practically, file-system extraction in the AFU state often yields more usable data than an encrypted physical dump.

Choose physical only when justified and when decryption is feasible.

SQLite: The Heart of Android Evidence

Most Android artifacts are SQLite databases. Analysts query them directly to recover messages, call logs, and timestamps.

Open read-only to avoid modifying the evidence file.
Timestamps are often Unix epoch milliseconds.

Inspect the contacts database from an extraction:

sqlite3 -readonly contacts2.db
sqlite> .tables
sqlite> SELECT display_name, data1
   ...> FROM view_v_contacts LIMIT 20;

Recovering Deleted SQLite Records

Deleting a row in SQLite often only marks its page space as free. Recoverable remnants live in:

Freelist pages and unallocated areas of the .db file.
The -wal write-ahead log, which retains pre-checkpoint versions of rows.

Carving tools reconstruct these records. Run a recovery pass over a database:

# Carve deleted rows from freelist + WAL
python3 sqlite_carver.py --db msgstore.db --wal msgstore.db-wal \
  --out recovered_messages.csv

# Cross-check live vs recovered counts in your notes

Timeline and Decoding Timestamps

Building a timeline correlates events across apps. The challenge is the many timestamp formats Android uses.

Unix epoch (ms) — most message databases.
Unix epoch (s) — many system logs.
WebKit/Chrome time — microseconds since 1601 (browser history).

Always normalize to UTC and note the device time zone. Example conversion in SQLite:

-- Convert epoch milliseconds to readable UTC
SELECT datetime(timestamp/1000, 'unixepoch') AS sent_utc,
       key_remote_jid, data
FROM messages
ORDER BY timestamp DESC LIMIT 25;

Key System Artifacts

Beyond app data, Android system artifacts reveal user behavior and device usage.

usagestats — which apps ran and when.
accounts.db / accounts_ce.db — linked Google and app accounts.
net stats / netpolicy — data usage per app.
Wi-Fi config (WifiConfigStore.xml) — known networks, useful for geolocation context.

These corroborate or contradict claims about who used the device and when.

Automated Parsing with ALEAPP

Manual parsing does not scale. ALEAPP (Android Logs Events And Protobuf Parser) ingests a file-system extraction and outputs a structured HTML/CSV report.

Parses usagestats, recent activity, notifications, app permissions, and more.
Use it to triage, then verify key findings by hand against the raw DBs.

Run ALEAPP against an extraction directory:

python3 aleapp.py -t fs -i ./android_filesystem/ -o ./aleapp_report/
# Open ./aleapp_report/index.html to review parsed artifacts

Validation and Anti-Tampering

Never trust a single tool. Validate automated output against the source data and across tools.

Re-run key queries manually in sqlite3 to confirm parser results.
Watch for anti-forensic signs: cleared logs, modified timestamps, secure-delete apps, or chat apps with disappearing-message settings.
Confirm the image hash still matches before and after analysis.

Reproducibility and cross-validation are what make findings defensible.

Quick Check

You are pulling a chat app's SQLite database. Which companion files must you also collect to avoid missing recently sent messages?

Recap: Android Acquisition and Analysis

You can now acquire and analyze Android evidence end to end.

App data lives in per-app sandboxes as SQLite DBs and XML prefs.
ADB backup = easy logical pull; file-system extraction (root) preserves WAL; physical is hardest under FBE.
Recover deleted records from freelist pages and WAL.
Normalize timestamps to UTC; decode epoch and WebKit formats.
Use ALEAPP to triage, then validate manually with sqlite3.
Watch for anti-forensic tampering and re-verify the image hash.

Next: the iOS side of the house.

Frequently asked questions

Is the “Android Acquisition and Analysis” lesson free?

Yes — the full text of “Android Acquisition and Analysis” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Android Acquisition and Analysis”?

Extracting and analyzing Android data. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Android Acquisition and Analysis” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy