Blog >> Android TikTok

Investigating Android TikTok

30/12/2022 Friday

TikTok is a social media platform and mobile application that enables users to create and share short videos set to music. The app was initially launched in 2016 under the name Musical.ly and was subsequently merged with the Chinese social media app Douyin in 2017. TikTok is renowned for its short-form, lip-sync, and comedy videos, as well as its user-generated content and creative challenges. The app can be downloaded for free from the App Store or Google Play Store and is available on both iOS and Android devices. TikTok has gained popularity among younger users and has been downloaded over two billion times worldwide.

Digital Forensics Value of Android TikTok

There are various pieces of information that may be of use in a digital forensics’ investigation involving TikTok. These may include the user's personal information, such as their name, email address, phone number, and location; video content created and shared on the platform; user contacts; and direct messages exchanged with other users. It is worth noting that the specific information that is accessible in a digital forensics’ investigation will be dependent on the specific circumstances and the data present on the examined device or servers.

Location and Structure of TikTok Artifacts

TikTok artifacts are found in the following location:
data/ com.zhiliaoapp.musically/databases/
data/com.zhiliaoapp.musically/shared_prefs/

Analyzing TikTok with ArtiFast

This section will discuss how to use ArtiFast to extract TikTok from Android and what kind of digital forensics insight we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android TikTok artifacts:

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android TikTok artifacts in ArtiFast.

Android TikTok Contacts

• Nickname - User nickname.
• Picture URL - The profile picture’s URL.
• Unique ID - Username.
• User ID - User unique identifier.
• Follow Status - User Follow status.
• Signature - User short biography data.

Android TikTok Messages

• Time - Date/Time message was sent.
• Sender - The message sender ID.
• Recipient - The message recipient ID.
• Message - Message content.
• Read - Indicates whether the message was read.
• Deleted - Indicates whether the message was deleted.
• Media Url - URL of media attached to the message.

Android TikTok Users Videos

• Time - Date/Time video uploaded.
• Video length - Video length in bytes.
• Video Name - The name of the video.
• Local Path - Video location in local storage.
• Thumbnail - Image generated to represent the video.
• Video Description - Shot description of the video content.

Android TikTok Users

• Name - Username.
• User ID - User unique identifier.
• Signature - User short biography data.
• Is Minor - Indicates whether user is underage.
• Is Blocked - Indicates whether user is Blocked.
• Following Count - Number of followings.
• Followers Count - Number of followers.
• Email - User email address.
• Location - User location information.
• Avatar Url - User avatar URL.
• Is Blocking - Indicates whether user is Blocking anyone.

For more information or suggestions please contact: ekrma.elnour@forensafe.com