I am examining an Android IP camera application with package name:
com.fnk.fnk
The APK contains Tuya/ThingClips-related IPC components.
Relevant strings/resources found in the APK include:
ENABLE_PRIVACY_MODE_BUTTON_ATTRIBUTE_ID
ipc_set_privacy_mode_switch
ipc_set_privacy_zone_settings
ipc_private_area_tips
privacy_zone_set_point
The app data directory is:
/data/user/0/com.fnk.fnk/
I have confirmed that these functions/resources exist, but I now need help identifying the actual forensic artifacts that store the configuration and history.
I am specifically trying to determine:
1. Which database, SharedPreferences file, XML/JSON file, device property or DP ID stores Privacy Mode / Privacy Zone / Private Area settings?
2. Where are the coordinates or geometry of privacy zones stored?
For example x/y values, width/height, rectangle coordinates or polygon points.
3. Is there any local Android artifact or cloud/device log showing when a privacy zone was enabled, changed or deleted?
4. Can the account or device that changed the privacy setting be identified?
5. Is ENABLE_PRIVACY_MODE_BUTTON_ATTRIBUTE_ID likely only a UI feature flag, or could it map to a Tuya/ThingClips device property?
6. Does privacy_zone_set_point look like a persisted zone-coordinate function, and where would you expect those values to be stored?
I have access to the APK and an extraction of the application files from the phone.
Any suggestions for specific databases, SharedPreferences files, SDK classes, DP IDs, log files or forensic artifacts to examine would be greatly appreciated.
This concerns forensic examination of an owned camera system.