Android WiFi History
WifiConfigStore.xml and netpolicy.xml record every network the device connected to, including SSID, BSSID (MAC), and encryption type — strong location inference.
Where to find it
Default filesystem paths and registry locations. Collect these with your preferred live-response or disk-image tooling.
- $/data/misc/wifi/WifiConfigStore.xml
- $/data/misc/apexdata/com.android.wifi/WifiConfigStore.xml
Forensic significance
Common scenarios in which this artifact becomes decisive evidence.
- Proving the device was at a specific location via BSSID
- Pattern-of-life — home, work, frequent venues
- Corroborating witness testimony with wireless beacons
MITRE ATT&CK mapping
Techniques this artifact can help detect or substantiate. Click a technique to view the official MITRE entry.
Tools that parse it
unJaena AI and other DFIR tools commonly used to extract evidence from this artifact.
Related artifacts
WiFi Profile Registry
Windows stores every SSID a machine has connected to under HKLM, along with connection timestamps and MAC address of the AP — strong location evidence.
macOS Bluetooth plist
System Bluetooth configuration plist records paired devices with their MAC address, display name, device type, and last seen / last connected timestamps.
Android SMS (mmssms.db)
Android Telephony provider stores SMS and MMS in a single SQLite database accessible via content providers, often recoverable even after app reinstall.
Android Call Log
contacts2.db logs every incoming, outgoing, missed, and rejected call with duration, contact, SIM slot, and call type including voicemail.
Stop parsing artifacts by hand
unJaena AI ingests disk images, live-response output, and mobile backups, then automatically correlates every artifact on this page — and 200+ more — into an investigator-ready timeline.
Try unJaena AI →