Investigating Android Contacts
08/09/2023 Friday
Android phone contacts refer to the collection of names, phone numbers, email addresses, and other relevant details of individuals or organizations that a phone user has stored in his/her mobile phone. These contacts allow the phone user to easily call, message, or email people without having to remember their contact information each time.
Digital Forensics Value of Android Contacts
Contacts can provide insight into the communication patterns of the device owner. They provide evidence of the relationships between the device owner and other individuals, potentially relevant to the investigation. This can include personal relationships, business contacts, or even potential witnesses. Third-party apps may also access and store contact information. Examining the contacts’ information stored by these apps can reveal additional insights into the device owner's interactions and activities.
Location of Android Contacts Artifacts
Android Contacts artifacts can be found at the following location:
data/com.android.providers.contacts/databases/contacts2.db
Analyzing Android Contacts Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Contacts artifact from Android machines’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Calls artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Calls artifact in ArtiFast.
Android Contacts
- Last Updated Date: The Last Updated Date of this contact information.
- ID: The unique identifier attached with this contact.
- Display Name: The name of this contact as registered by the phone owner.
- Phone Number: The phone number for this contact.
- Account Name: The account name associated with this contact in a third-party app.
- Number of Times Contacted: The number of times the phone owner contacted this contact.
- Source Account Type: The third-party application domain where this contact has been found.
- Is Starred: Indicates whether this contact has been starred by the phone owner or not.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
