## 4 Analysis and Findings
### Android Analysis
#### 4.2.1 Metamask  
All files related to the Android Metamask app were found in package \data\io.metamask, unless otherwise noted. The file named pref_store that is stored in the folder \app_webview contains the timestamp of the installation of the app (see Figure 21).  
The row _@MetaMask:walletconnectSessions_ within the table named _catalystLocalStorage_ within the SQLite3 file named _RKStorage_ in the path \databases contains the user-connected wallet addresses (see Figure 22). The same information can be found in the \files\persistStore\persist-root JSON file.  
Figure 21: App installation timestamp.  
Figure 20: Recovered ssaid(s) for both apps.  
Figure 22: The value recovered from the row (i.e.,@MetaMask:lastIncomingTxBlockInfo) that contains the user-connected wallets addresses and last time they were checked.  
Furthermore, the persist-root JSON file contains 19 objects that hold many valuable information. The addresses of the wallets on the app, balances, contacts, collectibles, and cipher are examples of what can be recovered from the engine object within the JSON persist-root file (see Figure 23). Moreover, the Metamask app allows the user to store contacts which can be seen in _addressBook_ in Figure 23). Other information on user accounts and when they were imported into the device can be recovered within the engine object inside the file persist-root (see Figure 24).  
Figure 23: The persist-root file that contains valuable information, this Figure show the two wallets addresses, contact address, collectibles, and cipher.  
In addition, app_webview\Default has a file named Cookies, this file is a database that stores cookies. One of these cookies values has a relatively close location to where we have populated the device (see Figure 29).  
The swapping operation was performed in the Metamask app, and we were able to recover detailed swapping information from app_webview\Default\LocalStorage\leveldb\000003.log, which confirms and complements the information found within the persist-root JSON file. This is a log file in the local storage of the app web view that keeps activities. Figure 30 shows the BNB swapping for Cake, along with other information for the transaction from 000003.log file.  
Figure 28: Number of times that the user opened the web services within the app.  
Figure 27: Content of settings, set alerts, another transaction activity, and user settings within the persist-root file.  
The folder \cache\image_cache\v2.ols100.1 contains folders that have.png images stored as.cnt extension, these images are for the cached images in the app. In addition, folder \cache has other snapshots that the app took.  
Additionally, the app provides white and black lists of phishing websites, where the app pulls this information once configured. This information is extracted from [[https://cdn.jsdelvir.net/gh/MetaMask/eth-phishing-detect@master/src/config.json7](https://cdn.jsdelvir.net/gh/MetaMask/eth-phishing-detect@master/src/config.json7)]([https://cdn.jsdelvir.net/gh/MetaMask/eth-phishing-detect@master/src/config.json7](https://cdn.jsdelvir.net/gh/MetaMask/eth-phishing-detect@master/src/config.json7)), and by navigating to one of the phishing websites, it provides the user with a warning (see Figure 31). At the time of writing the investigation, the file contained 15 fuzzy lists, 1594 whitelists, and 1454 blacklist links (see Figure 32).  
Figure 30: The 000003.log within the Local Storage of the app web view that kept activities of swap transactions.  
Figure 29: Cookie values show geolocation.