Android Forensics — ADB, SQLite, /data/data Databases & Cellebrite (CHFI v10 Obj 14.1)
Master EC-Council CHFI v10 Objective 14.1 — Android Forensics. It's in their pocket right now. It knows where they slept, who they texted at 3AM, every place they walked today. The phone is the witness that never sleeps — and on Android, almost every secret is one SQLite database away.
This lesson covers every Android forensic technique tested on the exam — Android architecture, acquisition types, ADB commands, key database locations, timestamp conversion, APK analysis, and anti-forensics.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📚 WHAT YOU'LL LEARN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Android architecture — sandbox, SELinux, FBE
✅ Acquisition types — logical vs file system (root)
✅ ADB commands — devices, pull, backup, logcat
✅ Key databases — mmssms.db, telephony.db, contacts2.db
✅ Android timestamps — Unix milliseconds
✅ APK analysis — unzip, jadx, CERT.RSA
✅ Anti-forensics — factory reset + encryption
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⏱ CHAPTERS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
0:00 Cold open — the witness that never sleeps
0:26 Android architecture
1:08 Acquisition types
1:45 Physical methods — JTAG / chip-off
2:23 ADB forensic commands
3:02 Key databases
3:38 Timestamps + Google account
4:14 APK analysis
4:50 Anti-forensics + Cellebrite
5:26 Recap + Obj 14.2
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🎯 EXAM QUICK REFERENCE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ACQUISITION — file system needs ROOT · no root = logical (ADB backup) only · physical = JTAG/chip-off
DATABASES — all at /data/data/[package]/databases/ · mmssms.db = SMS · telephony.db = call log · contacts2.db
TIMESTAMPS — Android uses Unix MILLISECONDS · divide by 1000 for Unix seconds (off by 1000x if you forget)
ADB — adb devices -l starts every case · adb logcat -d dumps the system log
APK — it's a ZIP · jadx decompiles DEX to Java · META-INF/CERT.RSA links the developer (same cert = same dev)
ANTI-FORENSICS — factory reset + default encryption (Android 6+) rotates the key = ciphertext · Cellebrite UFED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔗 Full EC-Council CHFI v10 course: https://study.it-learn.io
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
▶ SUBSCRIBE for the rest of the series — every objective, every domain.
▶ COMING NEXT: Domain 14 — Mobile Forensics (Objective 14.2: iOS)
#CHFI #ECCouncil #DigitalForensics #MobileForensics #Android #ADB #Cellebrite #ITLearn