Android Acquirer 94-Parser Registry
Every Artifact Sherlock Forensics Android Acquirer Reads
94 artifact parsers, generated from the registry that does the reading, not written by hand. The same list appears in the product on the What This Build Can Read screen.
Sherlock Forensics Android Acquirer decodes 94 distinct Android artifacts, spanning messaging and calls, email, browsing, location, media, installed and removed apps, accounts, connectivity and device state. Every parser names the on-device file it reads, so exporting a record hands over the source database whole, with its write-ahead log and a provenance note giving the path, SHA-256 and byte count. Publishing the list lets an examiner distinguish a device that never had an app from a tool that cannot read it, which are opposite conclusions about the same case.
This is the complete parser set for the current build. It was published at an examiner's request so anyone can confirm coverage before an acquisition. A build check fails if a new parser is added without naming the file it reads, which keeps every export tied to a verifiable source artifact. Jump to a category:
Messaging and calls 18 parsers
Chat apps, SMS and MMS, and the call log. Where a device has multiple messaging apps, each one is read separately, so absence of an app is distinguishable from absence of the tool.
| Parser | What it reads |
|---|---|
simplex | SimpleX Chat messages |
skype | Skype messages |
skype_contacts | Skype contacts |
skype_calls | Skype calls |
bugle | Google Messages (RCS/SMS/MMS) |
whatsapp | WhatsApp messages |
whatsapp_backup | WhatsApp messages (encrypted backup) |
telegram | Telegram messages |
bytedance_im | TikTok / Lemon8 direct messages |
wechat_biz | WeChat official-account posts (unencrypted feed) |
weibo | Weibo posts |
dynamite | Google Chat messages |
session | Session messages |
mmssms | Text messages (mmssms.db) |
mms | Multimedia messages (mmssms.db) |
calllog_sms | Text and multimedia messages in the call log (Samsung) |
call_log | Call log (calllog.db) |
aosp_call_log | Call log (contacts2.db) |
Email 3 parsers
Native and provider email stores.
| Parser | What it reads |
|---|---|
samsung_email | Samsung email (EmailProvider.db) |
aosp_email | Email (AOSP EmailProvider.db) |
gmail | Gmail messages |
Browsing and downloads 12 parsers
Browser history, searches, saved credentials, cookies, autofill and downloaded files across the built-in and stock browsers.
| Parser | What it reads |
|---|---|
chrome_history | Browser history (Chrome, Samsung Internet) |
chrome_visits | Browser visit events (Chrome, Samsung Internet) |
browser_search | Search queries (Chrome, Samsung Internet) |
omnibox_search | Address-bar searches (omnibox predictor) |
chrome_login | Saved logins (Chrome, Samsung Internet) |
chrome_cookies | Browser cookies (Chrome, Samsung Internet) |
chrome_autofill | Form autofill (Chrome, Samsung Internet) |
chrome_profiles | Saved address profiles (Chrome, Samsung Internet) |
chrome_bookmarks | Bookmarks (Chrome, Samsung Internet) |
stock_browser | Stock browser history and bookmarks (browser2.db) |
webview_cookies | In-app WebView cookies |
downloads | Downloaded files (Download Manager) |
Location and travel 11 parsers
On-device location history, photo geotags, mapped places, ride and navigation history, and GPS fixes.
| Parser | What it reads |
|---|---|
cmh_media | Media with location (Samsung cmh.db) |
cmh_places | Location history (Samsung cmh.db) |
maps_ugc | Google Maps photo locations |
maps_camera | Google Maps last camera position |
miui_gallery | Photo locations (MIUI Gallery) |
miui_weather | Weather cities (MIUI) |
uber_places | Uber places (place cache) |
waze_places | Waze places (user.db) |
network_diagnostic | Device GPS fixes (Samsung network diagnostics) |
semantic_location | Google on-device Location History |
ring_location | Ring registered address (home location) |
Media and photos 4 parsers
The media index, gallery collections, content tags and cloud photo libraries.
| Parser | What it reads |
|---|---|
media_store | Media files (MediaStore external.db) |
cmh_scenes | Photo content tags (Samsung media hub) |
cmh_stories | Gallery stories (Samsung media hub) |
google_photos | Google Photos library |
Apps and usage 16 parsers
Installed, owned and removed apps, permission usage, launch and usage history, and the home screen.
| Parser | What it reads |
|---|---|
play_apps | Installed apps (Play Store ledger) |
play_library | Owned apps, including uninstalled (Play library) |
play_data_usage | App data usage (Play Store ledger) |
app_usage | App usage sessions (Samsung ContextLog.db) |
removed_apps | Removed apps (Samsung ContextLog manage_app) |
packages_xml | Installed apps + permissions (packages.xml) |
proc_exit | App exit reasons (procexitinfo) |
pkg_predictions | App launches (launch predictor log) |
recent_tasks | Recent apps (recent_tasks) |
usagestats | App usage sessions (usagestats) |
usage_history | App usage history (usagestats) |
shortcuts | App shortcuts (shortcut_service) |
launcher | Home screen (launcher.db) |
xperia_launcher | Home screen (Xperia Home) |
appops | App permission usage (appops_accesses.xml) |
bixby_commands | Bixby quick commands |
Accounts and identity 11 parsers
Device accounts, contacts, SIM and subscriber identity, sync settings and wallet passes.
| Parser | What it reads |
|---|---|
contacts | Contacts (contacts2.db) |
accounts | Device accounts (contacts provider) |
account_manager | Device accounts (AccountManager) |
app_owner | Device-owner app identities |
map_accounts | Amazon account (map_data_storage_v2) |
sync_settings | Account sync settings (sync/accounts.xml) |
sim_info | SIM subscriptions (siminfo) |
carrier_config_log | SIM change history (carrier config loader) |
net_stats | Subscriber date windows (netstats) |
net_policy | Mobile subscribers (netpolicy.xml) |
google_pay_passes | Google Pay passes (event tickets) |
Connectivity and device state 12 parsers
Saved networks, Bluetooth pairings and transfers, power and battery history, device policies, clipboard and calendar.
| Parser | What it reads |
|---|---|
wifi | Saved WiFi networks (wpa_supplicant.conf) |
wifi_config_store | Saved Wi-Fi networks (WifiConfigStore.xml) |
bt_config | Bluetooth pairings (bt_config.conf) |
bluetooth | Bluetooth devices (paired and seen) |
bt_transfer | Bluetooth file transfers (btopp.db) |
power_off_log | Shutdown and reboot log (Samsung) |
power_events | Device power and boot events (Samsung security log) |
battery_history | Connectivity and radio history (batterystats) |
device_policies | Device administrators (device_policies.xml) |
encrypted_prefs | Decrypted app secrets (EncryptedSharedPreferences) |
clipboard | Clipboard history (keyboard) |
calendar | Calendar events |
Cloud documents 2 parsers
Cloud document indexes held on the device.
| Parser | What it reads |
|---|---|
gdrive_docs | Google Drive documents (DocList.db) |
gdrive_cello | Google Drive documents (Cello) |
Health, wearables and IoT 3 parsers
Watch and fitness data, mirrored notifications and connected-home device events.
| Parser | What it reads |
|---|---|
ring_events | Ring doorbell events (motion, dings) |
fitbit_notifications | Mirrored notifications (Fitbit watch) |
health_connect | Exercise, sleep and steps (Health Connect) |
Notes and personal 1 parsers
On-device notes and checklists.
| Parser | What it reads |
|---|---|
colornote | ColorNote notes and checklists |
Finance and crypto 1 parsers
Cryptocurrency wallets held on the device.
| Parser | What it reads |
|---|---|
mycelium | Mycelium Bitcoin wallet |
Confirm coverage before you acquire
The free edition detects the device and inventories what is present, so you can check these parsers against a specific handset before committing to an acquisition. The Forensic Edition at $399 one-time adds full extraction, court-ready PDF reports with per-artifact SHA-256 hashing and chain of custody.