Investigating Android Installed Applications
27/10/2023 Friday
Android installed applications records refer to the data and information stored on an Android device about the software applications installed on it. Android installed application is one of the generic android OS artifacts. The artifact contains information related to installed Applications in the android device. These records include details about the names of installed apps, their version numbers, installation dates, and other relevant information.
Digital Forensics Value of Android Installed Applications
As mentioned earlier, Installed Applications is a default artifact present on Android devices. This artifact can offer valuable insights into the user's installation activities, enabling the identification of specific applications installed on the device and their update status. Additionally, it includes installation timestamps, which can be used to create a timeline of events.
Location and Structure of Android Installed Applications Artifacts
In addition to the APK files stored in the user app date file, the Installed Applications artifact is stored in a database structure. The default locations of Installed applications records are:
data/user/0/com.android.vending/databases/localappstate.db
data/data/com.android.vending/databases/localappstate.db
Analyzing Android Installed Applications Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Installed Applications artifact from Android device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Installed Applications artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Installed Applications artifact in ArtiFast.
Android Installed Applications
- Required Android Version: The application’s required Android version.
- Target Android Version: The target Android version.
- Play Store URL: Possible Play Store URL.
- Data Delivery Date: The data delivery date and time.
- Auto Update: Indicates whether auto update is allowed or not.
- Install Request Date: The date and time of the installation request.
- Install Reason: The installation reason.
- Version Name: The version name.
- Version Code: The version code.
- Package Name: The installation package name.
- Application Name: The application name.
- Allow ADB Backup: Indicates whether ADB backup is allowed or not.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
