Key Takeaways
-
On Android, push messages from apps that use Firebase Cloud Messaging (FCM) pass through a shared system component: Google Play Services.
-
FCM-related records from different apps appear in a single LevelDB-based store, and each record identifies the receiving app and the time the message was received.
-
What the payload reveals depends on the app: the message text, an encrypted body, or only an event showing that a message arrived.
When the App Is Gone, Where Do You Look?
The messaging app was deleted before the device was seized. Its databases went with it. In many examinations, that is where the trail ends.
Mobile forensic analysis usually works app by app. Each app stores user activity in its own format, such as SQLite, Realm, LevelDB, or XML, and its schema can be changed with any update. Examiners identify and interpret every app and every version separately. Once the app is deleted, the target of that analysis can disappear entirely.
Why Does Firebase Cloud Messaging Matter to Mobile Forensics?
On Android, many apps receive push messages through Firebase Cloud Messaging (FCM), Google’s messaging service. On their way to each app, FCM messages pass through the same system component: Google Play Services (com.google.android.gms).
That shared path changes the question. Instead of asking what each app kept, examiners can ask what the shared layer kept, independent of how each app structures its own data.
What Did We Find in Google Play Services?
We triggered FCM data messages in widely used apps and examined the FCM-related artifacts in the com.google.android.gms data area. Records from every app appeared in a single LevelDB-based store, in a common key-value structure. Across the apps tested, each record identified the receiving app and the time the message was received.
The payload was a different story. Three patterns emerged:
-
Plain Text: The notification title and message text are readable once the record is decoded.
-
Encrypted: The message body is stored, but only in encrypted form.
-
Metadata Only: The payload holds only an event showing that a message arrived, with no message body.
The apps examined include LINE, Telegram, KakaoTalk, Signal, WhatsApp, TikTok, and BAND. Which app falls into which pattern, and what else appears next to the message body, is covered in the full Tech Content.
What Is Inside the Full Tech Content?
-
The artifact path and the key structure used to identify each record
-
App-by-app decoding results, including the fields that appear in plain text
-
How LevelDB storage behavior affects what can remain after deletion or update
-
What to collect alongside the file when checking for residual data
FCM artifacts do not replace app-level analysis, and storage formats may vary across app versions. They provide examiners with an additional source of evidence, particularly when the original app is no longer available.
Investigating an Android device where the app has already been deleted? Request the full Tech Content using the form below.
