<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Mobile Data Storage

## ADB Data Access (Android)
```bash
adb shell run-as com.app ls /data/data/com.app/
adb shell run-as com.app cat /data/data/com.app/shared_prefs/prefs.xml
adb pull /data/data/com.app/databases/app.db ./
adb backup -apk -shared com.app -f backup.ab
adb logcat -d | grep com.app
```

## SQLite Inspection
```bash
sqlite3 app.db ".tables"                  # List tables
sqlite3 app.db ".schema tablename"        # Show schema
sqlite3 app.db "SELECT * FROM users;"     # Query data
sqlite3 app.db ".dump"                    # Dump entire DB
```

## Objection (iOS)
```bash
env                                        # App sandbox paths
ios nsuserdefaults get                     # NSUserDefaults
ios keychain dump                          # Keychain items
ios keychain dump --json                   # JSON format
ios cookies get                            # Stored cookies
ios plist cat Info.plist                   # Read plist
sqlite connect Library/app.db             # Open SQLite DB
ls Documents/                              # Browse files
download /path/to/file local.file         # Pull file
```

## iOS Data Protection Classes
| Class | Protection |
|-------|-----------|
| `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` | Best — unlocked + no migration |
| `kSecAttrAccessibleWhenUnlocked` | Good — unlocked |
| `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly` | Moderate — after boot |
| `kSecAttrAccessibleAfterFirstUnlock` | Moderate — after boot + migration |
| `kSecAttrAccessibleAlways` | **INSECURE** — always accessible |

## Android Storage Locations
| Location | Access | Notes |
|----------|--------|-------|
| `/data/data/app/shared_prefs/` | App only | XML key-value |
| `/data/data/app/databases/` | App only | SQLite DBs |
| `/data/data/app/files/` | App only | Internal files |
| `/sdcard/Android/data/app/` | World-readable (pre-10) | External storage |
| `/data/data/app/cache/` | App only | Temp files |
