Summary

This chapter has been an in-depth study of specific Android applications, and how/where they store their data. We looked at 19 specific applications and discovered 9 different methods of storing and obfuscating data. Knowing that applications store their data in a variety of ways should help an examiner have a better understanding of an app's data that they are examining. This knowledge should, hopefully, push them to look harder when they can't find data they expect the app to have. An examiner has to be able to adapt to the changing world of application analysis. As applications constantly update, an examiner has to be able to update their own methods and abilities in order to keep up.

The next chapter will take a look at several free and open source tools to image and analyze Android devices and reverse engineer applications to discover where their data is stored.