# Android-Based Audio Video Navigation System Forensics: A Case Study
## 4 Android-Based AVN System Forensics
### Android 4.2.2-Based AVN System Forensics
#### 4.1.1 Bluetooth Data  
If passengers connect a mobile phone to the AVN system via Bluetooth, they can use the hands-free function of the AVN system to receive and send phone calls. In this case, Bluetooth-related apps record the data about the connected devices and phone calls. Bluetooth-related apps, such as Bluetooth.apk, BTMedia.apk, BTService.apk, BTSetup.apk and BTPhone.apk, are located in the subdirectories of /system. The data recorded by these apps is stored as database files in /data/data/com.android.providers.bluetooth/database/. Table 3 shows the database file, table and attribute names of the main artefacts. BTSetup.db stores the information about the connected devices. BTContacts.db and BTCallHistory.db store the contact lists and phone call history of each connected mobile phones, respectively.  
The main Bluetooth data artefacts are the MAC (media access control) address of the connected mobile devices, device name, contacts and recent call history. The MAC address of the connected mobile device can be found in BTSetup.db, BTFavorites.db, BTContacts.db and BTCallHistory.db. The target AVN systems can establish a total of five concurrent Bluetooth connections. We verified that the number of tuples of the BTDevList table is limited to five. As shown in Figure 3, the Bluetooth MAC address of the connected mobile device is stored as attribute dev#_name in the Switch_Index table of BTContacts.db and BTCallHistory.db, where '#' is the index of the MAC address in theBTDevList table in BTSetup.db. For example, the MAC address of the third mobile device in the BTDevList table of BTSetup.db is also stored in attribute dev3_name in the Switch_Index table of BTSetallHistory.db.  
A user can provide a name to their mobile phone. This name is broadcast to neighbouring devices via Bluetooth or WiFi. The target AVN systems store this name in attribute devname in the BTDevList table of BTSetup.db. The contact list of the mobile phone can be found in BTSetnotacts.db which contains the name and phone number of each contact. The call history (log) can be found in BTSetallHistory.db. It contains the call type, the name and phone number of the party retrieved from the contact list and the date and time of the call. The call type is denoted as Dialled (outgoing), Received (incoming) or Missed.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**File Name** & **Table** & **Attribute** & **Artifact** \\ \hline \multirow{3}{*}{BTSetup.db} & \multirow{3}{*}{BTDevList} & devname & device name \\ \cline{3-4}  & & address & MAC \\ \cline{2-4}  & Switch\_Index & dev\#\_name & MAC \\ \hline \multirow{3}{*}{BTContacts.db} & Switch\_Index & dev\#\_name & MAC \\ \cline{2-4}  & & name & given name \\ \cline{3-4}  & \multirow{3}{*}{DevfContacts} & frame & family name \\ \cline{3-4}  & & num\# & phone number \\ \hline \multirow{6}{*}{BTCallHistory.db} & Switch\_Index & dev\#\_name & MAC \\ \cline{2-4}  & & type & dialed \textbackslash{} received \textbackslash{} missed \\ \cline{1-1} \cline{2-4}  & & name & name \\ \cline{1-1} \cline{2-4}  & & frame & frame \\ \cline{1-1} \cline{2-4}  & & number & phone number \\ \cline{1-1} \cline{2-4}  & & tel\_type & [cell, home, other] \\ \cline{1-1} \cline{2-4}  & & date\_time & call date \\ \hline \hline \end{tabular}
\end{table}
Table 3: Bluetooth data of the Jellybean-based AVN systems.