Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Save more on your purchases! discount-offer-chevron-icon
Savings automatically calculated. No voucher code required.
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Practical Mobile Forensics

You're reading from   Practical Mobile Forensics A hands-on guide to mastering mobile forensics for the iOS, Android, and the Windows Phone platforms

Arrow left icon
Product type Paperback
Published in May 2016
Publisher
ISBN-13 9781786464200
Length 412 pages
Edition 2nd Edition
Tools
Concepts
Arrow right icon
Authors (3):
Arrow left icon
Rohit Tamma Rohit Tamma
Author Profile Icon Rohit Tamma
Rohit Tamma
Satish Bommisetty Satish Bommisetty
Author Profile Icon Satish Bommisetty
Satish Bommisetty
Heather Mahalik Heather Mahalik
Author Profile Icon Heather Mahalik
Heather Mahalik
Arrow right icon
View More author details
Toc

Table of Contents (14) Chapters Close

Preface 1. Introduction to Mobile Forensics FREE CHAPTER 2. Understanding the Internals of iOS Devices 3. iOS Forensic Tools 4. Data Acquisition from iOS Devices 5. Data Acquisition from iOS Backups 6. iOS Data Analysis and Recovery 7. Understanding Android 8. Android Forensic Setup and Pre Data Extraction Techniques 9. Android Data Extraction Techniques 10. Android Data Analysis and Recovery 11. Android App Analysis, Malware, and Reverse Engineering 12. Windows Phone Forensics 13. Parsing Third-Party Application Files

Application data storage

Almost all applications rely on SQLite for data storage. These databases can be stored internally on the device or on the SD card for relevant phones. When SQLite is used, temporary memory files are commonly associated to each database to make SQLite more efficient. These files, which were previously mentioned, are write ahead logs (WAL) and shared memory files (SHM). These files may contain data that is not present in the SQLite database. Few tools will parse this information, but the ones that are offered by Sanderson Forensics, will get you started. Go to http://sandersonforensics.com/forum/content.php?261-Timelining-events-in-a-WAL-based-SQLite-DB. We can see several WAL and SHM files associated with various WhatsApp database files in the following screenshot:

Application data storage

An SHM and WAL example

In addition to SQLite databases, other devices rely on Plist, XML, JSON, and DAT files for application data storage, account data storage, purchase information...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image