Blog >> Android Call logs

Investigating Android Call logs

25/08/2023 Friday

Call logs on Android mobile phones are records that document the history of incoming, outgoing, and missed calls made from or received by a specific Android device. This information can be essential for individuals to keep track of their communications and quickly identifying who they were in contact with as call logs display the names or labels associated with phone numbers if they are stored in the device's contacts.

Digital Forensics Value of Call logs

Call logs are essential sources of information in digital forensics investigations. They provide a detailed record of incoming, outgoing, and missed calls, along with timestamps and durations. Hence, they contribute to building comprehensive behavioral patterns and routines of individuals. Properly analyzing and interpreting call log data can provide valuable insights for investigators, aiding in the pursuit of justice and truth.

Location of Android Call logs Artifacts

Android Call logs artifacts can be found at the following location:
data/com.android.providers.contacts/databases/calllog.db

Analyzing Android Call logs Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Android Call logs artifact from Android machines’ files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Calls artifact:

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Calls artifact in ArtiFast.

Android Calls

• Call Date: The date/time when this call was made.
• Number: The phone number of the call partner.
• Name: The name of the call partner if it is registered in this phone’s address book.
• Call Type: Indicates whether the call was Missed, Ongoing, or Outgoing.
• Duration: The duration of the call (in seconds).
• Country: The country code of the call partner’s phone number.
• Geocoded Location: The geocode of the call partner’s phone number.
• Formatted Number: The formatted form of the call partner’s phone number.
• Normalized Number: The normalized form of the call partner’s phone number.
• Lookup URL: The lookup URL of the call partner if it is registered in this phone’s address book.

For more information or suggestions please contact: kalthoum.karkazan@forensafe.com