MOBILE FORENSICS

Forensic analysis of Android contacts

Contact details are among the key sources of information on an Android device. They may include telephone numbers, email addresses, organisational details and other information. As part of an IT forensic investigation, these can provide important insights into communication patterns and device usage.

Contacts databases (e.g. contacts2.db)
Telephone numbers
Email addresses
Contact groups and favourites
Linked contacts
Synchronisation information
Timestamps and change history
SQLite databases
App- and manufacturer-specific contact artefacts

TECHNICAL BACKGROUND

Technical Fundamentals

Android stores contacts in system-level databases and synchronises them – depending on the configuration – with various account services.

Forensically relevant artefacts include, amongst others:

  • •Contacts databases (e.g. contacts2.db)
  • •Telephone numbers
  • •Email addresses
  • •Contact groups and favourites
  • •Linked contacts
  • •Synchronisation information
  • •Timestamps and change history
  • •SQLite databases
  • •App- and manufacturer-specific contact artefacts

Storage locations and data structures vary depending on the Android version, the manufacturer and the account services used.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, contact databases, synchronisation artefacts and other relevant information are examined using recognised IT forensic tools and manual analysis. Contacts are cross-referenced with call logs, messaging data and timestamps in order to present communication relationships in a clear and traceable manner. All stages of the investigation are documented in a reproducible manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What contacts are stored on the device?
  • ✔Which phone numbers and email addresses have been saved?
  • ✔Which accounts have been synchronised?
  • ✔Is it technically possible to recover deleted contacts?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Deleted contacts, disabled synchronisation or manufacturer-specific changes may affect the scope of the available data. Individual contacts or the times at which changes were made should therefore not be assessed in isolation.

Analysing Android contacts provides valuable insights into communication partners and the use of a device. Only by evaluating all available evidence together is it possible to reach a reliable IT forensic conclusion.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have the contacts on an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Where are contacts stored?
Depending on the Android version and manufacturer, in system-level SQLite databases and, where applicable, in synchronised accounts.
Can deleted contacts be recovered?
That depends on the data set and the artefacts available.
Are contact groups relevant from a forensic perspective?
Yes. They may allow conclusions to be drawn about the organisation and use of the contact details.
Is synchronisation data analysed?
Yes. You can provide details of Google, Samsung, Exchange or other account services.
Could an expert report be drawn up on this matter?
Yes. The test results are documented in a clear and transparent manner and assessed from a technical perspective.