Investigating Android Google Pay Account
10/07/2026 Friday
Google Pay is a mobile payment and wallet application used on Android
devices to manage payment-related account access and associated Google
account information. Account identifiers, email details, and
active-account status values may be stored by the application and can be
recovered from the device when the related application data is
available.
Digital Forensics Value of Android Google Pay Account
Android Google Pay Account artifacts can provide useful
account-identification evidence during mobile investigations. The
artifacts left by the application may contain the email address
associated with the Google Pay account, the unique account identifier,
and whether the account was the current active account on the device.
These elements can be used to associate Google Pay activity with a
specific user account, confirm which account was configured on the
device, and correlate payment-application usage with other Android
account, application, and timeline evidence.
Location of Android Google Pay Account
Android Google Pay Account artifacts are commonly stored in the Google
Pay shared preferences file. The artifact location is associated with
the following Android application data path:
/data/user/<USER_ID>/com.google.android.apps.walletnfcrel/shared_prefs/global_prefs.xml
Legacy equivalent:
/data/data/com.google.android.apps.walletnfcrel/shared_prefs/global_prefs.xml
The /data/user/<USER_ID>/ path represents the application data
area for the Android user profile. The /data/data/ path is the legacy
equivalent commonly used for the primary user application data area.
Analyzing Android Google Pay Account Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Google
Pay Account artifacts from Android machines' files and what kind of
digital forensics insights can be gained from the artifacts.
After a case has been created and evidence has been added for the
investigation, at the Artifact Selection phase, the Android Google Pay
Account artifact parser can be selected:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via Artifact View or Timeline View, with indexing, filtering, and searching capabilities. Below is a detailed description of Android Google Pay Account artifact in ArtiFast.
Google Pay Account
- Email : The email address associated with the Google Pay account is shown.
- UID : The unique Google Pay account identifier is shown.
- Is Current Account : Whether the account is the currently active Google Pay account on the device is indicated.
For more information or suggestions please contact: enes.turan@forensafe.com
