CHFI (312-49) Digital Forensics Simulation
This scenario tests your ability to identify and analyze core Android operating system databases. You will learn to map a suspect's digital footprint by correctly interpreting centralized account synchronization artifacts.
Investigation Scenario
During an investigation into corporate espionage, a suspect's Android smartphone was seized under a valid search warrant. Digital forensics investigators successfully performed a physical acquisition of the device, bypassing the lock screen and extracting the raw bit-stream image of the `/data` partition.
During the Examination phase, the lead analyst mounts the forensic image and begins parsing the `system` directory to establish the suspect's identity and determine which third-party cloud services may hold exfiltrated data.
Evidence Collected
The analyst must correctly interpret the contents of this specific SQLite database to justify requests for additional search warrants directed at cloud service providers.
Question
During a mobile-forensics investigation of an Android device, an analyst recovers a file named "accounts.db". What type of information is typically stored in this database?
Expert Analysis
1. What the evidence shows
The artifact accounts.db is an active SQLite database located within the protected /data/system/users/0/ path. This path indicates it belongs to the primary user (User 0) on the Android device. The presence of the -journal file indicates recent write activity or an uncommitted transaction at the time of acquisition.
2. Forensic Stage
Examination / Analysis. The physical collection is complete. The analyst is examining the raw SQLite database to identify relevant logical artifacts that dictate the next steps in the investigation.
3. Why the correct answer is correct
A. Information about the user accounts (e.g., Google, Facebook) synced with the device is the correct answer. In the Android OS architecture, accounts.db is the centralized SQLite database used by the AccountManager. It stores the registered user profiles linked to the device, including Gmail addresses, Exchange accounts, WhatsApp accounts, Facebook profiles, and associated synchronization authentication tokens.
4. Why the other options are wrong
- B. Call logs and text messages: These are typically stored in provider-specific databases such as
mmssms.db(for SMS/MMS) andcalllog.dborcontacts2.db, located in the/data/data/com.android.providers.telephony/orcontactsdirectories. - C. Location history: Location data is generally cached in
gservices.db, network location caches, or specific app databases like Google Maps (e.g.,gmm_myplaces.db). - D. Web browsing history: Browsing history is stored within the specific browser application's sandbox. For Chrome, this is typically
HistoryorWeb Datalocated under/data/data/com.android.chrome/.
5. Real-world forensic action
A digital forensic investigator would extract accounts.db and open it using an SQLite browser. They would query the accounts table to dump all name (email/username) and type (service provider) fields. This data is critical for expanding the scope of the investigation, as it provides the exact account identifiers needed to draft search warrants for cloud service providers (Google, Meta, Microsoft) to acquire data not stored locally on the physical device.
MINI LESSON: The Concept of "Digital Footprinting" in Mobile Forensics
Artifact Interpretation: Mobile devices are gateways to cloud data. A localized physical extraction may not contain all relevant evidence if the user heavily relies on cloud storage or syncing.
Forensic Workflow: Analyzing accounts.db should be one of the very first steps in a mobile examination. By identifying exactly *who* the device thinks the user is across various platforms, investigators can establish attribution and quickly pivot from device forensics to cloud forensics via legal process.
Ready for the next investigation?
Explore more CHFI simulations and master the digital forensics process.
Explore more CHFI simulations