viaForensics

I played around with Google Goggles today and was quite impressed.  Like any good forensic geek, I wanted to understand better what happened behind the scenes.  Below are some observations from the data the app persisted on the NAND:

Application data is stored in /data/data/com.google.android.apps.unveil
Following directories exist: cache, databases, files, lib, shared_prefs
Last picture I took was [...]

I was taking a look at the /data/data/ directory on the Droid and here are some interesting items:

Contact database

/data/data/com.android.providers.contacts/database/contacts2.db (thank goodness it’s not contacts1.db)

Combines data from Google, Exchange, Facebook and more
table status_updates has date/time and status update from contacts in your Contact list and Facebook
table raw_contacts has info about source of contact and other items
Is [...]

While we continue our R&D on getting a full dd image from a Motorola Droid, I thought it would be interesting to do a quick write up on Google Maps Navigation artifacts.  Since we don’t yet have full access to the system, this preliminary analysis focuses on the residual data left on the SD Card.

SD [...]

I was taking a look at the filesystem on my Motorola Droid and discovered they have a new YAFFS2 directory called /config.  The T-Mobile/HTC devices did not have this directory.  Interestingly, you can’t cd into the directory…you get the following error:

$ cd config
cd: can’t cd to config

but you can get a little info:

$ ls /config
wifi
public
lost+found

Oddly [...]