Android Acquirer 346-Parser Registry
Every Artifact Sherlock Forensics Android Acquirer Reads
346 artifact parsers, generated from the registry that does the reading, not written by hand. The same list appears in the product on the What This Build Can Read screen.
346 artifact parsers, organized. Sherlock Forensics Android Acquirer reads what a phone actually holds across 15 categories: messaging, social, browsers, accounts, location, media, calls, cloud, financial and crypto. That includes the vault, burner and hidden apps built to keep evidence out of sight. Search the full list below or jump to any category.
This is the complete parser set for the current build, all 346 registered parsers, published at an examiner's request so anyone can confirm coverage before an acquisition. It is generated from the registry that does the reading, so it cannot list a parser the build does not have or miss one it does. A build check fails if a new parser is added without naming the file it reads, which keeps every export tied to a verifiable source artifact.
Messaging & Chat 59
bugleGoogle Messages (RCS/SMS/MMS)dynamiteGoogle Chat messagesgarmin_messagesMirrored messages (Garmin Connect)groupmeGroupMe messagesgroupme_contactsGroupMe group membersimoimo messagesimo_accountimo accountimo_callsimo callsimo_contactsimo contactskatana_messagesFacebook app Messenger mailbox (msys)kikKik messageskik_contactsKik contactslife360_messagesLife360 circle messagesmeweMeWe chatmmsMultimedia messages (mmssms.db)mms_partsMMS attachment filesmmssmsText messages (mmssms.db)redditReddit chatsecuresmsSignal messages and attachmentssecuresms_callsSignal call logsecuresms_contactsSignal contactssessionSession messagessilentphone_accountSilent Phone account and configurationsilentphone_objectsSilent Phone cached objectssilentphone_zrtp_peersSilent Phone ZRTP peerssimplexSimpleX Chat messagesskypeSkype messagesskype_callsSkype callsskype_contactsSkype contactsskype_mmkvSkype settings store (MMKV), with superseded valuesslackSlack messagesslack_accountsSlack signed-in workspacesslack_callsSlack huddlesslack_contactsSlack workspace membersteamsMicrosoft Teams messagesteams_callsMicrosoft Teams callsteams_contactsMicrosoft Teams contactstelegramTelegram messagestelegram_mediaTelegram media files and storiesteleguardTeleGuard messagesteleguard_callsTeleGuard callsteleguard_contactsTeleGuard contactsthreemaThreema account and the state of its encrypted storethreema_dbThreema messages and contacts (decrypted)tinderTinder chat messagestinder_inboxTinder inbox noticesviberViber messagesviber_callsViber callsviber_contactsViber phonebookviber_mediaViber media filesviber_prefsViber account, registration and settings storewechat_bizWeChat official-account posts (unencrypted feed)whatsappWhatsApp messageswhatsapp_backupWhatsApp messages (encrypted backup)whatsapp_contactsWhatsApp contacts and statuseswhatsapp_mediaWhatsApp media fileswireWire account and peer deviceswire_callsWire calls (app log)wire_mediaWire cached attachmentsSocial Media 32
berealBeReal Postsbereal_accountBeReal Accountbereal_contactsBeReal Friends and Requestsbereal_mediaBeReal Cached Mediabereal_searchesBeReal Searchesbytedance_imTikTok / Lemon8 direct messagesdiscordDiscord messagesdiscord_callsDiscord callsdiscord_contactsDiscord users seengettrGETTR messagesgettr_contactsGETTR accounts and peoplegettr_mediaGETTR cached imagesgettr_notificationsGETTR notificationskatana_contactsFacebook app contactskatana_local_mediaFacebook app composer mediamastodonMastodon posts and notificationsmastodon_accountsMastodon signed-in accountsmastodon_searchesMastodon recent searchesmessengerFacebook Messengermewe_accountMeWe signed-in accountmewe_feedMeWe cached feed posts and commentsmewe_locationsMeWe shared locationstwitter_timelineTwitter/X cached tweetssnapchatSnapchat messagessnapchat_contactsSnapchat friends and contactssnapchat_contentSnapchat on-disk content and player cachesnapchat_memoriesSnapchat memoriestwitterTwitter (X) direct messagestwitter_callsTwitter (X) callstwitter_contactsTwitter (X) accounts seentwitter_searchesTwitter (X) searchesweiboWeibo postsLocation, Maps & Travel 32
alltrails_accountAllTrails account and last known locationalltrails_photosAllTrails photosalltrails_trackAllTrails recorded trackscmh_mediaMedia with location (Samsung cmh.db)cmh_placesLocation history (Samsung cmh.db)garmin_devicesPaired watch and syncs (Garmin Connect)garmin_locationLast significant location (Garmin Connect)garmin_logApplication log (Garmin Connect)garmin_notificationsMirrored notifications (Garmin Connect)garmin_profileAccount holder (Garmin Connect)google_odlhLocation history (Google on-device timeline)life360_eventsLocation trace (Life360 event store)life360_locationsLife360 locations and watched placesmap_accountsAmazon account (map_data_storage_v2)maps_cameraGoogle Maps last camera positionmaps_placesGoogle Maps saved places and directionsmaps_ugcGoogle Maps photo locationsmiui_galleryPhoto locations (MIUI Gallery)network_diagnosticDevice GPS fixes (Samsung network diagnostics)ring_locationRing registered address (home location)runtime_permissionsCamera, microphone and location grants (runtime permissions)maps_navigationGoogle Maps navigation sessionsmaps_last_tripGoogle Maps last routemaps_searchesGoogle Maps searchessemantic_locationGoogle on-device Location Historysemantic_rawRaw location fixes (Play Services semantic location)uber_placesUber places (place cache)ulr_prefsGoogle location reporting and history settings, per accountwaze_placesWaze places (user.db)weather_clockWeather location (Samsung)what3words_list_ownerwhat3words list ownerwhat3words_placeswhat3words saved placesBrowsers & Web 37
battery_historyConnectivity and radio history (batterystats)browser_downloadsBrowser download list (Chrome, Samsung Internet, Opera, Brave, Edge)browser_searchSearch queries (Chrome, Samsung Internet, Opera, Brave, Edge)chimeNotification history (Google Chime)chrome_autofillForm autofill (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_bookmarksBookmarks (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_cookiesBrowser cookies (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_cardsSaved payment cards and Google Payments account (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_dipsSites interacted with and sites that stored data (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_historyBrowser history (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_loginSaved logins (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_profilesSaved address profiles (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_visitsBrowser visit events (Chrome, Samsung Internet, Opera, Brave, Edge)chromium_cacheBrowser HTTP cache (Chrome, Samsung Internet, Opera, Brave, Edge)clipboardClipboard history (keyboard)duckduckgoDuckDuckGo history and searchesduckduckgo_appDuckDuckGo open tabs, fireproofed sites and bookmarksedge_panelSamsung Edge panel (pinned apps, panel service starts)files_by_google_searchesFiles by Google search historyfirefox_cacheBrowser HTTP cache (Firefox, Tor Browser)firefox_cookiesBrowser cookies (Firefox, Tor Browser)firefox_historyBrowser history (Firefox)firefox_searchesSearch queries (Firefox)mozilla_storesSite permissions, form history, downloads and closed tabs (Firefox, Tor Browser)offline_pagesSaved web pages (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_tabsChrome open tabschrome_sync_sessionsSynced tabs and the devices that synced them (Chrome, Samsung Internet, Opera, Brave, Edge)chrome_top_sitesChrome most-visited sitesrecovery_historyRecovery boots and factory resetsstock_browserStock browser history and bookmarks (browser2.db)torbrowser_bookmarksBookmarks (Tor Browser)torbrowser_historyBrowser history (Tor Browser)torbrowser_top_sitesTop sites (Tor Browser)torbrowser_tor_stateTor daemon state and entry guardstorbrowser_usageApp usage and install identity (Tor Browser)usage_historyApp usage history (usagestats)webview_cookiesIn-app WebView cookiesCalls, Contacts & Voicemail 16
accountsDevice accounts (contacts provider)aosp_call_logCall log (contacts2.db)call_logCall log (calllog.db)calllog_smsText and multimedia messages in the call log (Samsung)cash_app_contactsCash App counterpartiescontactsContacts (contacts2.db)dialer_lookupNumber identities (Google dialer lookups)google_dialer_idsGoogle caller ID: who and where a number was identified asgoogle_voiceGoogle Voice messageslineLINE messages, contacts and in-app browserphone_linkLinked PC (Microsoft Phone Link)protonmail_contactsProton Mail contactsgoogle_duoGoogle Duo/Meet callssim_infoSIM subscriptions (siminfo)telecom_accountsCalling accounts (telecom register)threads_appThreads posts, accounts and contactsMedia, Photos & Camera 16
cmh_scenesPhoto content tags (Samsung media hub)cmh_storiesGallery stories (Samsung media hub)exoplayer_cacheCached streamed video (ExoPlayer)gallery3dGallery media cache (Samsung)gallery3d_activityGallery activity and deletions (Samsung)gallery3d_searchGallery searches (Samsung)google_photosGoogle Photos libraryimage_cachesCached pictures in app image cachesmedia_storeMedia files (MediaStore external.db)myfiles_thumbnail_cachePreview cache (Samsung My Files)pixel_search_indexSearch-index thumbnails and routines (Pixel)samsung_mediaMedia index (Samsung provider)samsung_clipboardCopied pictures (Samsung clipboard)samsung_storyStory Service media groupings (Samsung)torbrowser_thumbnailsTab thumbnails (Tor Browser)zoom_filesZoom cached imagesCloud, Files & Backups 18
appsearchAppSearch on-device index (Icing document log)bt_transferBluetooth file transfers (btopp.db)downloadsDownloaded files (Download Manager)dropbox_entriesSystem crash and boot log (DropBoxManager)fcm_queuedQueued push payloads (Firebase Cloud Messaging)files_by_googleFiles by Google file index and Safe Foldergdrive_celloGoogle Drive documents (Cello)gdrive_docsGoogle Drive documents (DocList.db)gmail_downloadsGmail attachment fileshoneyboard_clipboardClipboard files on disk (Samsung Keyboard)megaMEGA (MEGAchat messages, cloud file tree, account)myfiles_indexFile index and frequent folders (Samsung My Files)myfiles_recentRecently used files (Samsung My Files)myfiles_searchFile search terms (Samsung My Files)omnibox_searchAddress-bar searches (omnibox predictor)onedriveMicrosoft OneDrive (cloud files, sharing, uploads)samsung_trashSamsung trash (deleted files)sync_settingsAccount sync settings (sync/accounts.xml)Email, Calendar & Notes 20
aosp_emailEmail (AOSP EmailProvider.db)calendarCalendar eventscolornoteColorNote notes and checklistsgcalendarGoogle Calendar app eventsgcalendar_accountsGoogle Calendar accounts and calendarsgmailGmail messagesgoogle_pay_passesGoogle Pay passes (event tickets)google_wellbeingApp and sleep events (Google Digital Wellbeing)keepGoogle Keep noteskeep_note_editsGoogle Keep deleted note textprotonmailProton Mail messagesring_eventsRing doorbell events (motion, dings)samsung_emailSamsung email (EmailProvider.db)samsung_notesSamsung Notessamsung_wellbeingApp and device events (Samsung Digital Wellbeing)spotifySpotify settings, paired audio devices and queued eventstask_snapshotsRecents screen captures (task snapshots)tutanotaTuta Mail accountstutanota_alarmsTuta Mail calendar alarmstutanota_configTuta Mail client configurationAccounts, Auth & Credentials 8
adb_keysAuthorised debugging computers (adb keys)account_managerDevice accounts (AccountManager)android_usersDevice profiles (names, creation, last login)downloads_request_headersDownload request credentials (Download Manager)install_sessionsInstalls that had not finished (package installer sessions)meta_analyticsMeta account and device ids (analytics batches)usagestatsApp usage sessions (usagestats)zoom_accountZoom account and encrypted storesFinancial, Crypto & Payments 7
cash_appCash App paymentscash_app_accountsCash App account, aliases and funding instrumentsmyceliumMycelium Bitcoin walletspaySamsung Wallet cards, receipts and card artspay_card_artSamsung Wallet card art filesspay_preregSamsung Wallet pre-approved card offersspay_stateSamsung Wallet provisioning state and owner profileHealth & Fitness 4
google_fitActivity and sleep sessions (Google Fit)health_connectExercise, sleep and steps (Health Connect)turbo_app_usageApp use times (Device Health Services)turbo_batteryBattery and charging (Device Health Services)Dating 3
tinder_accountTinder accounttinder_matchesTinder matchestinder_profile_photosTinder profile photosVoice, Assistant & Automation 3
android_autoCars connected (Android Auto)bixby_commandsBixby quick commandsbixby_routinesBixby Routines (automations, triggers and when they ran)System, Device & App Metadata 70
app_mmkvApp key/value stores (MMKV), excluding Skypeapp_ownerDevice-owner app identitiesapp_searchesIn-app search box history (Gmail and any other app that keeps one)app_ssaidPer-app Android ID (SSAID)app_standbyApp standby buckets (how much each app is used)app_usageApp usage sessions (Samsung ContextLog.db)appopsApp permission usage (AppOps)appops_discreteApp permission usage log (appops discrete)badge_countsUnread badges at extraction (Samsung)battery_dailyBattery level, screen-on time and package changes, by daybattery_usagePer-app battery usage (Settings)bluetoothBluetooth devices (paired and seen)bootstatFactory reset, build and boot markers (bootstat)bt_configBluetooth pairings (bt_config.conf)build_propsDevice identity (build.prop)carrier_config_logSIM change history (carrier config loader)device_healthApp network and process windows (Samsung device health)device_policiesDevice administrators (device_policies.xml)device_propertiesDevice properties (timezone, USB, carrier)device_rolesSystem role holders (default SMS, dialer, browser, launcher)dex_useCode loads: which package loaded which dex, and whendex_use_listCode loads recorded in the older text storeecho_notificationsNotified conversations (Android System Intelligence)fitbit_notificationsMirrored notifications (Fitbit watch)gass_appsAttested apps, including removed onesgboard_typingTyped text (Gboard training cache)gms_checkinPlay Services check-in (SIM state, device identity)google_castGoogle Cast devices and probed network addressesgoogle_settingsGoogle partner settingsgraphics_statsApps the platform recorded drawing, by dayidentifiersDevice and subscriber identifiers (corroboration)ims_registrationCarrier IMS registration (Samsung)launcherHome screen and app drawer (Launcher3)launcher_iconsApp names as the launcher showed them (icon cache)miui_weatherWeather cities (MIUI)nearby_devicesBluetooth accessories seen nearby (Fast Pair and Nearby discovery)net_policyMobile subscribers (netpolicy.xml)net_statsSubscriber date windows (netstats)notification_historyNotification history (title and text, per profile)oneui_homeHome screen (Samsung One UI)package_restrictionsPer-profile package state (install reason, never launched)package_usagePackage last-use times and dynamically loaded codepackages_xmlInstalled apps + permissions (packages.xml)people_indexCorrespondent identities across apps (System Intelligence)pkg_predictionsApp launches (launch predictor log)play_appsInstalled apps (Play Store ledger)play_data_usageApp data usage (Play Store ledger)play_libraryOwned apps, including uninstalled (Play library)play_protectPlay Protect install ledgerplay_searchesGoogle Play searchespower_eventsDevice power and boot events (Samsung security log)power_off_logShutdown and reboot log (Samsung)privacy_dashboardPermission use (Samsung Privacy Dashboard)proc_exitApp exit reasons (procexitinfo)recent_tasksRecent apps (recent_tasks)removed_appsRemoved apps (Samsung ContextLog manage_app)samsung_app_powerApp network and screen windows (Samsung battery stats)samsung_iconsApp names as One UI Home showed them (Icon.db)samsung_power_logPower on, off and reboot log (Samsung eRR.p)samsung_scpmDevice name and sales region (Samsung policy manager)settings_searchSettings search queriessettings_storeDevice settings and posture (per profile)shortcutsApp shortcuts (shortcut_service)shutdown_checkpointsShutdowns, and what asked for each onetombstonesNative crash dumps (tombstones)wifiSaved WiFi networks (wpa_supplicant.conf)wifi_config_dbWhen each saved Wi-Fi network was savedwifi_config_storeSaved Wi-Fi networks (WifiConfigStore.xml)wifi_hotspotThe Wi-Fi hotspot this handset broadcastxperia_launcherHome screen (Xperia Home)No parser matches that search. Clear it to see all 346.
Confirm coverage before you acquire
The free edition detects the device and inventories what is present, so you can check these parsers against a specific handset before committing to an acquisition. The Forensic Edition at $399 one-time adds full extraction, court-ready PDF reports with per-artifact SHA-256 hashing and chain of custody.