Google Tasks - Android Forensics analysis

Everyone have lots of tasks to complete in a day and we use different apps for organising our daily tasks/meet-ups etc. Google Tasks is one of the simple application to get go. It is a user friendly application and easy to use, organise etc.

Analysis

The Google Task data folder can be found at /data/data/com.google.android.apps.tasks/.

The main files of interest is data.db, which can be found in files/tasks-{ID}.

We get a good amount of tables to sift through for analysis as you can see below from the DB Browser screenshot:

data.db Tables

Using the data collected from emulator, I found useful information populated in the following tables:

• TaskLists
• Tasks

Note: Data is stored as blob in these both tables.

TaskLists

This table contains some metadata about when the list Created, Modified, List name, List ID and few other details.

Interesting columns in this table are:

• TaskListId - Contains the ID for the list. Default ID is ~default.
• EffectiveTaskList/OrginalTaskList - A blob data, contains metadata information about the list like created, modified, List Name, List ID.

Decoding the blob data using CyberChef, we can see it pulls out List name, List ID, and timestamps and other information.

{
    "1": "~default",
    "2": {
        "1": "My Tasks",
        "3": "user"
    },
    "3": {
        "1": [
            {
                "1": "cm-giEvLNfv7qtpq",
                "2": [
                    {
                        "1": "elSNabzEnFtR9QsE"
                    },
                    {
                        "1": "dIXAjJLovsKNqXsr"
                    }
                ]
            },
            {
                "1": "Ry9dIkNjAdwTlaSn"
            }
        ]
    },
    "6": {
        "1": 1623872134,
        "2": 158266000
    },
    "7": {
        "2": 5
    },
    "8": {
        "1": 1628267601,
        "2": 852175000
    }
}

Some of the keys that I figured out are:

• 1 -> Task List ID
• 2 - 1 -> List Name
• 2 - 3 -> Created User
• 3 -> ID’s for the tasks & Sub tasks present in the List, Still needs to be verified
• 6 -> List Created Timestamp
• 7 -> Unknown
• 8 -> List Last modified timestamp

Tasks

This table contains the most important data like task names, task details, due data & time, task created & last modification time stamps, task completion time, task completion status.

Interesting columns in this table are:

• TaskId - ID for the task
• DueDate - Due date for the task.
• Completed - Completion status of the task.
• EffectiveTask/OriginalTask - Task creation, last modification & completion time, Task name, details, due date & time, Timezone
• HasDirtyState - Gives details about whether a task is dirty or not.

From my testing, I got this as the structure of the blob data present in EffectiveTask:

{
    "1": "DQn3azgcN9huA4Tb",
    "2": {
        "1": 1,
        "2": "task1",
        "3": "details in task1, list 16:16",
        "4": {
            "1": 2021,
            "2": 8,
            "3": 31
        },
        "5": {
            "1": 1629458276,
            "2": 408000000
        },
        "10": "5IAve9dCmbU854lU"
    },
    "3": {
        "1": 1629458282,
        "2": 331087000
    },
    "4": "AwjRql9PeUnXpW5i",
    "8": {
        "2": 5
    },
    "9": {
        "1": {
            "2": {
                "1": 2021,
                "2": 8,
                "3": 31
            },
            "3": {
                "1": 18
            },
            "4": "Asia/Kolkata",
            "6": {
                "1": 1630413000
            }
        }
    },
    "11": {
        "1": 1629456419,
        "2": 138443000
    },
    "13": {
        "1": "117075487121734099140"
    }
}

Some of the keys I figured out are:

• 1 -> Task ID
• 2 - 1 -> Completion status
• 2 - 2 -> Task Name
• 2 - 3 -> Task Details
• 2 - 4 -> Due Date
• 2 - 5 -> Completion time
• 2 - 10 -> Task Recurrence ID
• 3 -> :ast Modified Time
• 4 -> Task List ID
• 8 -> Unknown
• 9 -> Due Time, Timezone of user
• 11 -> Creation Time
• 13 -> Unknown

These are some the useful details from Google Tasks database.

ALEAPP parsers have been added for retriving the Task, Task details, and timestamps etc. Other artifacts will be added soon while I continue my research.

Get ALEAPP here - https://github.com/abrignoni/ALEAPP