## 4 Analysis and Findings
### Android Analysis
#### 4.2.2. Trust Wallet  
All Trust Wallet-related files were located in package \data\com.wallet.crypto.trustapp, unless otherwise noted. \files is an essential folder for the Trust Wallet app. This folder contains the two wallets created in the scenario Wallet m-2-1653501108488 and m-2-1653424125494; all NFTs that are purchased or transferred into the app are stored here. These two databases are named using their creation epoch time. In addition, the folder \files contains all QR images generated using the app named as <WalletAddress>.png.  
The file com.wallet.crypto.trustapp_preferences.xml located in the folder shared_prefs has the names of the wallets, the creation time, and the addresses and active coins within the wallets. Furthermore, the date of installation of the app was recoverable from app_webview>pref_store. Furthermore, similar to what was recovered in the iOS version of the app, we were able to recover the count of how many times the web services/website have been accessed by the user of the app in a table named OriginInfoTable within the following database app_webview>Default (see Figure 33).  
Figure 31. Metamask app warning to the user.  
Figure 32. Metamask app recovered lists.  
Figure 33. Count of how many times the web services/websites have been accessed by the user.  
Additionally, due to the fact that the app uses webview and HTTPS requests, these are cached and can be found in a folder called \cache. Furthermore, there is another folder named image_manager_disk_cache that contains cached images. Crucial information that points to the deviceID can also be recovered with the cache folder, which can be found in the HTTPS requests (see Figure 34).  
Android and iOS file structures are different since the applications are developed differently. Trust Wallet uses realm databases to store information about currencies and wallets. However, the Trust Wallet app uses different database structures for Android and iOS. In Android, there are four realm databases that store information about bookmarks, app configurations, general wallet information, and an encrypted database named wallets_info. This allows investigators to obtain more information from Android devices. On the other hand, iOS uses only two realm databases, which are encrypted.  
When realm databases on iOS were examined, they were all encrypted; however, this is not the case with the recovered realm databases named m-2-1653424125494 and m-2-1653501108488, which contain information about enabled cryptocurrencies and their addresses, transaction history, decentralized apps used, and owned collectibles (e.g., NFTs). Figure 35 shows the different classes (tables) stored within the wallet m-2-1653501108488 realm database. In Figure 35, the table named RealCollectiblesItem is opened and we can see the NFT contract, ID, category, name, and image URL. Furthermore, Table RealAnsset contains all the cryptocurrency coins that the user has with their balances (e.g., available, locked, frozen, stacked, rewards, and pending) wallet addresses, and if these coins were manually added by the user. In addition, Table RealTransaction, provides detailed information on transactions, such as timestamp, amount, gas fees, and transaction hash. With this information, you can use tools, such as Ciphertrace [69], to gain intelligent insight into transactions.  
Throughout the analysis of Trust Wallet, we came across ciphertexts, salt, and IV, but were unable to decrypt these secrets. The assumption is that the salt and IVs found in the files can be used to decrypt encrypted realm databases.