Investigating Android Burner
04/04/2025 Friday
Android Burner is an app designed primarily to protect its users’
privacy by providing them with temporary, disposable phone numbers.
These generated phone numbers can be used for making calls, signing up
for services, or texting without revealing the users’ real personal
number. When a user is done with the created phone number, he/she can
delete or 'burn' it, making it unusable and preventing others from
contacting him/her on that number.
Digital Forensics Values of Android Burner
The forensic value of Android Burner lies primarily in the services it
provides, which focus on protecting users’ privacy and concealing their
real personal phone numbers. While the app is designed to protect
privacy, users may potentially misuse these services for illegal
activities, such as harassment, fraud, or other crimes. Therefore,
analyzing any left-behind artifacts can help investigators examine usage
patterns and correlations with other digital activities to gather
insights into such activities.
Location of Android Burner
Android Burner artifact can be found at the following location:
*/ data/data/com.adhoclabs.burner/databases/burnerDatabase.db
Analyzing Android Burner Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Burner
artifacts from Android machines’ files and what kind of digital
forensics insights we can gain from the artifact.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select Android
Burner artifact parser:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Burner artifacts in ArtiFast.
Android Burner User Information
- Date Created: The date when the user account was created.
- User ID: The unique identifier for the Burner user.
- Phone Number: The phone number associated with the Burner user.
- Auto Reply Message: The auto-reply message set by the user.
- Feature Set Name: The name of the feature set associated with the user.
- Calling: Indicates whether calling is enabled.
- Custom Voicemail: Indicates whether custom voicemail is enabled.
- Message Auto Reply: Indicates whether message auto-reply is enabled.
- MMS: Indicates whether MMS is enabled.
- Reverse Number Lookup: Indicates whether reverse number lookup is enabled.
- Unlimited Messages: Indicates whether unlimited messages are available.
- Unlimited Minutes: Indicates whether unlimited minutes are available.
- Video: Indicates whether video is enabled.
- Voicemail Transcription: Indicates whether voicemail transcription is enabled.
- Remaining Minutes: The remaining minutes available to the user.
- Remaining Texts: The remaining texts available to the user.
- Total Minutes: The total minutes available to the user.
- Total Texts: The total texts available to the user.
- Expiration Date: The date when the subscription expires.
- Number Type: The type of phone number.
- Call Ring Enabled: Indicates whether call ring is enabled.
- Hex Color: The hexadecimal color associated with the burner.
- Incoming Call Number Display: The display type for incoming call numbers.
- Burner Name: The name of the burner.
- Notifications Enabled: Indicates whether notifications are enabled.
- VOIP Enabled: Indicates whether VOIP is enabled.
- Voicemail Transcription Enabled: Indicates whether voicemail transcription is enabled.
- Last Updated: The last time the information was updated.
- Call Forward - Call Enabled: Indicates whether call forwarding for calls is enabled.
- Call Forward - Text Enabled: Indicates whether call forwarding for texts is enabled.
- Call Forward - Verified: Indicates whether call forwarding verification is completed.
Android Burner Subscription Information
- User ID: The unique identifier of the user associated with the subscription.
- Date/Time: The date when the subscription was created.
- Renewal Date: The date when the subscription will be renewed.
- SKU: The stock-keeping unit (SKU) of the subscription.
- Store: The store where the subscription was purchased.
- Trial: Indicates whether the subscription is a trial version.
- State: The current state of the subscription.
- Canceled: Indicates whether the subscription has been canceled.
- Price: The price of the subscription.
- Type: The type of the subscription.
Android Burner Messages
- Message ID: The unique identifier of the message.
- User ID: The unique identifier of the user who sent or received the message.
- Burner ID: The burner account associated with the message.
- Contact: The phone number of the contact associated with the message.
- Is Group Conversation: Indicates whether the conversation is a group conversation.
- Date Created: The date and time when the message was created.
- Message: The content of the message.
- Direction: Indicates whether the message is incoming or outgoing.
- Read Status: Indicates whether the message was read.
- Message Type: The type of the message, such as Text or Media.
- State: The delivery state of the message.
- Last Updated: The last time the message details were updated.
- SID: The unique session identifier for the message.
Android Burner Contacts
- User ID: The unique identifier of the user associated with the contact.
- Phone Number: The phone number of the contact.
- Contact Name: The name of the contact.
- Blocked: Indicates whether the contact is blocked.
- Burner IDs: The unique identifiers of burner accounts associated with the contact.
- Images: Profile images of the contact.
- Muted: Indicates whether the contact is muted.
- Notes: Additional notes about the contact.
- Date Created: The date when the contact was created.
- Last Updated: The last time the contact details were updated.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
