ALEAPP: Android Logs Events And Protobuf Parser
| Artifact | Data Stored | Exec | Create | Delete | Persist | User | Net | PrivEsc | Timestomp | MITRE | Tools | Location |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| packages.xml | Installed apps, perms, install times | ⚠ | ❌ | ❌ | ⚠ | ⚠ | ❌ | ⚠ | ⚠ | T1409 | cat packages.xml | /data/system/packages.xml |
| packages.list | UID ↔ package mapping | ❌ | ❌ | ❌ | ❌ | ⚠ | ❌ | ⚠ | ❌ | T1033 | cat packages.list | /data/system/packages.list |
| appops.xml | Runtime permission usage | ⚠ | ❌ | ❌ | ⚠ | ⚠ | ⚠ | ⚠ | ❌ | T1410 | cat appops.xml | /data/system/appops.xml |
| settings_secure.xml | Accessibility, security toggles | ⚠ | ❌ | ❌ | ✅ | ⚠ | ❌ | 🔥 | ❌ | T1546 | grep enabled_accessibility_services | /data/system/users/0/settings_secure.xml |
| device_policies.xml | Device admin apps | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | 🔥 | ❌ | T1548 | cat device_policies.xml | /data/system/device_policies.xml |
| usagestats/ | App usage timeline | ⚠ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | T1057 | strings usagestats/* | /data/system/usagestats/ |
| recent_tasks/ | Recently opened apps | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | T1033 | ls recent_tasks | /data/system/recent_tasks/ |
| battery-stats.xml | App activity (background usage) | ⚠ | ❌ | ❌ | ❌ | ⚠ | ❌ | ❌ | ❌ | T1496 | cat battery-stats.xml | /data/system/battery-stats.xml |
| job/jobs.xml | Scheduled background jobs | ⚠ | ❌ | ❌ | ✅ | ❌ | ❌ | ⚠ | ❌ | T1053 | cat jobs.xml | /data/system/job/ |
| alarm_history.xml | AlarmManager triggers | ⚠ | ❌ | ❌ | ⚠ | ❌ | ❌ | ⚠ | ❌ | T1053 | cat alarm_history.xml | /data/system/ |
| netpolicy.xml | Network usage rules | ❌ | ❌ | ❌ | ⚠ | ❌ | ✅ | ❌ | ❌ | T1041 | cat netpolicy.xml | /data/system/netpolicy.xml |
| accounts.xml | User accounts | ❌ | ❌ | ❌ | ⚠ | ✅ | ⚠ | ⚠ | ❌ | T1078 | cat accounts.xml | /data/system/accounts.xml |
| dropbox/ | Crash + debug logs | ⚠ | ❌ | ❌ | ❌ | ⚠ | ❌ | ❌ | ❌ | T1005 | ls dropbox | /data/system/dropbox/ |
| procstats/ | Process execution stats | ⚠ | ❌ | ❌ | ❌ | ❌ | ⚠ | ⚠ | ❌ | T1057 | cat procstats/* | /data/system/procstats/ |
/data/data/<pkg>/shared_prefs | App configs, tokens | ⚠ | ⚠ | ⚠ | ✅ | ⚠ | ⚠ | ⚠ | ⚠ | T1552 | cat *.xml | /data/data/<pkg>/shared_prefs/ |
/data/data/<pkg>/databases | SQLite DBs (logs, messages) | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | ❌ | ⚠ | T1005 | sqlite3 *.db | /data/data/<pkg>/databases/ |
/data/data/<pkg>/files | App files, payloads | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | T1105 | ls files/ | /data/data/<pkg>/files/ |
/data/data/<pkg>/cache | Temp data | ⚠ | ⚠ | ⚠ | ❌ | ⚠ | ⚠ | ❌ | ⚠ | T1070 | ls cache/ | /data/data/<pkg>/cache/ |
/data/data/<pkg>/app_webview | Cookies, sessions | ⚠ | ⚠ | ⚠ | ⚠ | ⚠ | 🔥 | ❌ | ⚠ | T1550 | sqlite3 Cookies | /data/data/<pkg>/app_webview/ |
/data/data/<pkg>/lib | Native libraries | ⚠ | ❌ | ❌ | ⚠ | ❌ | ⚠ | ⚠ | ❌ | T1620 | strings *.so | /data/data/<pkg>/lib/ |
/data/data/<pkg>/no_backup | Persistent hidden data | ⚠ | ⚠ | ⚠ | 🔥 | ❌ | ⚠ | ⚠ | ⚠ | T1564 | ls no_backup/ | /data/data/<pkg>/no_backup/ |