Investigating Android Device Health Services
21/06/2024 Friday
Device Health Services is a system application that comes installed by default on most of the modern Android devices. This application collects data and uses it to customize the user's experience and optimize resource usage by managing the device's sensors. With Device Health Services, users can for example gain insights into battery usage, predict how long the battery will last based on current usage patterns, and receive tips to extend battery life.
Digital Forensics Value of Android Device Health Services
The artifacts left behind by the Android Device Health Services application represent a rich source of information for forensic examiners. For example, examiners can determine which application was in use at a specific time, as well as the device’s battery level and charging status at any given moment. This information can be used to establish timelines, verify user behavior, and detect anomalies that may indicate tampering or misuse.
Location and Structure of Android Device Health Services Artifacts
Android Device Health Services artifacts can be found at the following location:
*/com.google.android.apps.turbo/databases/turbo.db
*/com.google.android.apps.turbo/shared_prefs/app_usage_stats.xml
*/com.google.android.apps.turbo/databases/bluetooth.db
Analyzing Android Device Health Services Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Device Health Services artifacts from Android machines’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Device Health Services artifacts parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Device Health Services artifacts in ArtiFast.
Android Device Health Services Battery Usage:
- Recorded Date/Time - The date and time when the battery data has been recorded.
- Battery Level - The recorded battery level percentage of the device at that point of time.
- Timezone - The timezone the device is set to at that point of time.
- Charging Type - The charging type.
- Battery Saver - Indicates whether the device is set to use battery saver mode or not.
Android Device Health Services Application Usage:
- Recorded Date/Time - The date and time when the battery data has been recorded.
- Package Name - The bundle name of the application used.
Android Device Health Services Bluetooth Device Information:
- Recorded Date/Time - The date and time when the battery data has been recorded.
- Battery Level - The recorded battery level percentage of the device at that point of time.
- Timezone - The timezone the device is set to at that point of time.
- Bluetooth MAC Address - The MAC address of this bluetooth device.
- Bluetooth Device ID - The unique identifier of this bluetooth device.
- Volume Level - The volume level.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
