Name typical Android artifacts collected during investigations.

• A. Call logs, SMS/MMS, contacts, app data
• B. Photos, calendar data, emails, and cloud backups
• C. Browser history, external storage artifacts, and app caches
• D. Location history and device identifiers

Answer: (A)

Capturing communications and app activity is central to Android investigations. Call logs show who was contacted, when, and for how long, giving a timeline of phone interactions. SMS/MMS messages provide the content of text communications, which can reveal plans, agreements, or relationships. Contacts establish who the user interacted with and can help map numbers to known people. App data captures information stored by installed apps—such as chat histories, in-app messages, settings, and usage patterns—that can illuminate what actions were taken, when, and with which services.

While other artifacts like photos, calendar data, emails, and cloud backups are often valuable, they depend on specific apps or online accounts and may not be present locally or fully accessible in every case. Browser history, external storage artifacts, and app caches can be useful but are more variable in reliability and scope. Location history and device identifiers are important too, but they do not by themselves provide as comprehensive a view of user activity as the combination of call logs, SMS/MMS, contacts, and app data.