There are three main files in /data/system i.e. packages.xml, packages.list, appops.xml and package-usage.list these are confusing as these contain too many information I just want to know the details like,
1. What is the main difference between packages.xml and packages.list? Which one is more important forensically?
2. In packages.list , the single entry is written as follows,
com.adobe.reader 10104 0 /data/data/com.adobe.reader default 3003,1028,1015
first comes package name, then UID, then path to /data/data, but what about 'default' and '3003,1028,1015' ?
3. Similarly, in package-usage.list, single row is written as follows,
com.android.calendar 1503220315144
again, first one is package name, second one is a timestamp but what kind of timestamp it is? Does it tell the first used time? or last used time?
4. Last, in Appops.xml, permissions about each app are written as follows,
<pkg n="com.google.android.youtube">
<uid n="10100" p="false">
<op n="32" t="1503163913568" />
<op n="40" t="1503147294707" d="68" />
</uid>
</pkg>
Now, n in <pkg tag refers to name of package, n in <uid refers to value of uID, I need the details about <op> tag what is n and t and d in it? Some apps have same n but different d, why so ?
Looking forward for quick response.
Regards.