Reviewing data storage on Android: preferences, databases and backups
You examine the traces an app leaves on a phone using prepared data exports: you look for sensitive data in preference files, SQLite databases, cache, external storage and backups, and recommend the fix.
Level 201 · 22 lessons · 18 practice labs
Lessons
The app data directory
- Layout of the data directory: shared_prefs, databases, files, cache
- File permissions and ownership: who can read what
- What counts as sensitive: tokens, personal, health and payment data
- Working from an export: examining without altering the evidence
- Short task: classify the files in an app's data export by type
Preferences and databases
- Reviewing SharedPreferences files
- Reading DataStore and protobuf files
- Reviewing a SQLite database: tables, schema and traces of deleted rows
- Is the encrypted database really encrypted: header and key handling
- Other stores: Realm, file-based caches, WebView data
- Short task: find the personal data kept in plaintext in a preference file and a database
Leak channels
- Files left on external and shared storage
- Cache, temporary files and thumbnails
- Looking for sensitive data in a logcat export
- Keyboard cache, clipboard and the recent-apps snapshot
- Short task: find the token leaking in a log export and in the cache
Backups and keys
- Backup archives: what leaves the device when allowBackup is on
- Auditing data extraction rules
- Verifying Keystore use from code and data
- Writing a storage finding and verifying the fix
- Short task: open a backup archive and list the files that should not be in it
Capstone
- Capstone: audit and report on the storage of a clinic appointment app
Practice labs
- Recognise the folders in a data export: Map the preference, database, file and cache folders in an app's data directory export.
- Classify files by type and sensitivity: List the files in the export by type and mark those holding personal data.
- Find the misconfiguration from file permissions: Find the file readable by other apps in the permission and ownership listing and report it without altering the evidence.
- Find the plaintext password in a preferences file: Find the key holding a password in the XML files under shared_prefs.
- Assess a preference value that looks encrypted: Decode a value that is merely Base64-encoded and prove that this is not encryption.
- Extract the fields from a DataStore file: Decode a protobuf DataStore file without its schema, find the sensitive fields and recommend a fix.
- List the tables and row counts in a database: Use sqlite3 to pull an app database's schema and the row count of each table.
- Find personal data kept in plaintext in a database: Show the columns in the Lavinya Klinikleri app's database where ID numbers and diagnoses are stored plainly.
- Verify a supposedly encrypted database and examine WAL traces: Determine from the file header whether the database is really encrypted and report the deleted rows left in the WAL file.
- Find the token in a logcat export: Find the line writing a Bearer token in the log dump and which class it comes from.
- Find the ID image left in the cache: Find the undeleted ID photo thumbnails in the cache folder and recommend a fix.
- Audit export files on external storage: Find the reports the app left on shared storage, classify their contents and combine three leak channels into one finding.
- Read the backup setting from the manifest: Find the allowBackup and data extraction rule settings.
- Open a backup archive and list its contents: Open the prepared backup archive and list the files that should not be in it.
- Write data extraction rules and verify against the archive: Write the rule file and show that the fixed version's backup archive has no session or database files.
- Confirm Keystore use from the code: Find in jadx output whether the key is generated in the Keystore.
- Prove an app keeps its key in a file: Document, with both code and data, an app that uses an encrypted database but keeps the key in a preferences file.
- Audit the storage of a clinic appointment app: Gather preference, database, cache and backup findings in one report and write a verifiable fix for each.
About this course
You examine the traces an app leaves on a phone using prepared data exports: you look for sensitive data in preference files, SQLite databases, cache, external storage and backups, and recommend the fix.
What you will learn
- The app data directory
- Preferences and databases
- Leak channels
- Backups and keys
- Capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.