I spend a lot of time analyzing Android devices and can process data using a variety of tools, both commercial and open source. As is well known, only by using multiple tools can one minimize errors, validate results across tools, and cover a greater number of artifacts, since each tool processes different files with different methods.

During these analyses, I noticed that many SQLite databases present on Samsung Android devices are not currently parsed by most tools, even though they may contain potentially relevant information for a forensic investigation. Some databases are already supported by some applications. However, many others deserve attention.

DISCLAIMER!

1. The test was conducted on different Samsung devices, but the goal of this post is not to provide detailed test results, but rather to encourage research and development of new plugins or parsing modules.
2. These databases were not found on Google Pixel, Xiaomi, Oppo, or other Android devices, and they are unique for Samsung.
3. There may be errors that need validation!

“\data\system” folder

pkgPredictions.db

This database is used by the system to predict app usage patterns. It includes the table tbl_Sample with columns:

• running_pkg: the name of the package in execution.
• launch_time: the time the app was launched.
• activity_name: the name of the activity in execution.
• screen_orientation: the orientation of the screen at launch time.

Useful for reconstructing user habits and app interaction trends.

WifiConfigStore.db

This database contains saved Wi-Fi configurations. The table configs includes:

• CONFIG_KEY: a string that includes the SSID and encryption type.
• Creation Time: useful for determining when the device first connected to a specific network.

wifigeofence.db

This database stores geolocation data associated with Wi-Fi networks. It includes:

• config_key: similar to WifiConfigStore.db, identifies the network.
• latitude_major and longitude_major: provide geolocation data.
• time_major contains connection timestamp.

“com.sec.android.sdhms” package

Samsung Device Health Manager Service is a system package found on Samsung devices. It includes several databases that may contain valuable forensic information:

• **thermal_log**: contains Network Statistics and CPU Data. In my tests, CPU data was retained for approximately 30 days, while network statistics were available for only 5–7 days.
• **sec_batterystats**, **sec_batterystats_history**, and **sec_batterystats_ext**: these databases store battery usage information. However, retention was very short — typically 1–2 days.
• anomaly.db: includes a table called config_history that logs various system events, including BOOT_COMPLETED with corresponding timestamps.Other packages and databases

“com.samsung.android.fast” package

This package is associated with Samsung Secure Wi-Fi Service.

The secure_wifi.db database contains a table named **eventlog**, which logs various system-level broadcast events.

Key columns include:

• time_stamp: the time the event occurred.

• extra: contains Android Intent Actions such as:

• android.net.wifi.STATE_CHANGE

• android.net.conn.TETHER_STATE_CHANGED

• android.intent.action.LOCKED_BOOT_COMPLETED

• android.intent.action.TIME_SET

These entries can be useful for reconstructing device activity, such as network usage, boot events, and time manipulation.

“com.samsung.android.mcfds” package

This package is associated with Samsung Continuity Service, which supports cross-device functionality.

It includes several databases of potential forensic interest:

• **context_engine_database**: contains a table named ActivityMoveDataEntity with a column TYPE that includes values such as STATIONARY, WALKING, and VEHICLE. Other potentially relevant tables include GPSDataEntity and ScanEntity.

• **SleepDetection.db**: includes a table called screen_data with columns such as:

• ScreenState: a boolean (0 or 1) likely indicating whether the screen is on or off.

• useKeyGuard: a boolean (0 or 1) likely referring to device lock/unlock status.

• userPresent: a boolean (0 or 1) possibly indicating user presence or interaction.

These databases may help reconstruct user activity, movement patterns, and device usage states.

“com.samsung.android.smartsuggestions” package

This package is part of Samsung’s Smart Suggestions system, which provides context-aware recommendations to users. It includes the database ContextDatabase.db, which contains a table named ContextHistoryEntity.

Key columns include:

• lifeContextID: with values such as launch_app and charging, indicating the type of context event.
• lifeContext: for rows where lifeContextID is launch_app, this column contains the package name of the app that was launched.

This database may be useful for identifying app usage patterns and device charging events, contributing to timeline reconstruction and user behavior analysis.

“com.samsung.android.privacydashboard” package

This package is related to Samsung Privacy Dashboard It includes the database **permission_db**, which contains a table named permissionAccessInformations. This table logs:

• The package name that accessed a permission
• The specific permission used
• The timestamp of access

In tested cases, the retention period was approximately 7 days. Notably, this database appears to contain additional permission events not present in the standard Privacy Dashboard logs located in /system/appops/discrete/, making it a valuable source for forensic analysis of app behavior and permission usage

“com.sec.android.provider.badge” package

This package corresponds to Samsung’s BadgeProvider, which manages notification badges on app icons.

It includes the database **badge.db**, which tracks:

• The package name of the app.
• The activity class associated with the badge.
• The badge count (number of unread notifications).

This database can be useful for reconstructing notification states and understanding user interaction with apps.