Wi-Fi analysis

Wi-Fi is not technically an application (as evidenced by the fact that it is not recovered from /data/data), but it is an invaluable source of data that should be examined. So, we'll briefly discuss it here. Wi-Fi connection data is found in /data/misc/wifi/wpa_supplicant.conf. The wpa_supplicant.conf file contains a list of access points that the user has chosen to connect to automatically (this is set by default when a new access point is connected to). Access points that the user has "forgotten" through the device settings will not be shown. If the access point requires a password, that would also be stored in the file in plain text. In the following example, the NETGEAR60 access point required a password (ancientshoe601), while hhonors did not:

Note

The presence of a Service Set ID (SSID) in this file does NOT mean that this device connected to that access point. These settings are saved to a user's Google account and added to the device when that account is set up. An...