This chapter has been an in-depth study of specific Android applications, and how/where they store their data. We looked at 19 specific applications, and discovered 9 different methods of storing and obfuscating data. Knowing that applications store their data in a variety of ways should help an examiner have a better understanding of the data that they are examining, and hopefully push them to look harder when they can't find data they expect an app to have. An examiner has to be able to adapt to the changing world of application analysis; since applications constantly update, an examiner has to be able to update their own methods and abilities in order to keep up.

The next chapter will take a look at several free/open source and commercial tools to image and analyze Android devices.