Wi-Fi analysis
Wi-Fi is not technically an application (as evidenced by the fact that it is not recovered from /data/data
), but it is an invaluable source of data that should be examined. So, we'll briefly discuss it here. Wi-Fi connection data is found in /data/misc/wifi/wpa_supplicant.conf
. The wpa_supplicant.conf
file contains a list of access points that the user has chosen to connect to automatically (this is set by default when a new access point is connected to). Access points that the user has "forgotten" through the device settings will not be shown. If the access point requires a password, that would also be stored in the file in plain text. In the following example, the NETGEAR60
access point required a password (ancientshoe601
), while hhonors
did not:
Note
The presence of a Service Set ID (SSID) in this file does NOT mean that this device connected to that access point. These settings are saved to a user's Google account and added to the device when that account...