Mobile Fundamentals · Mobile Operating Systems · Lesson 1 of 4

Where App Data Lives

Every app keeps its own files. See where.

Each app, its own files

Every app on a phone keeps its own records. Most of them store those records in small databases, usually SQLite files. A database is a set of tidy tables, with rows and columns, saved on the phone. Your texts, your call log and your browsing history each sit in a separate file that belongs to the app that made it.

Apps save this data so they can work smoothly. Messages remembers every conversation so you can scroll back months. The Health app counts your steps through the day so it can draw your weekly chart. You never see these files, but they're there, and almost every row carries a timestamp.

Those timestamps are why these files matter so much in investigations. A forensic examiner who extracts an iPhone can open each database and rebuild a timeline: who you texted, where you went, and when you were moving or sitting still.

The file names and folders in this lab are for iPhones. Android phones keep similar records, but under different names and in different places.

Tap each app on the simulated phone to see what it stores and where its database lives.

Name the file

Once you know where data lives, you can go straight to it. Forensic examiners learn the names of the most important database files by heart, and forensic tools look for those same names automatically.

On an iPhone, the Messages app keeps everything in one SQLite database in the Library/SMS folder. That single file holds ordinary SMS texts and iMessages. For each message it records who sent it, when it arrived, whether it was read, and links to any photos or other attachments.

The file's name comes from history. The first iPhone in 2007 could only send plain SMS texts. Apple added iMessage in 2011, but the database kept its short, old-fashioned name, sms.db, even though it now stores far more than SMS.

Android phones store texts too, but in a different database with a different name, so an examiner has to know both systems.

Type the exact file name below. Capital letters don't matter.