# Plaso Android related event formatters.
---
type: 'conditional'
data_type: 'android:airtag:event'
enumeration_helpers:
- input_attribute: 'rssi'
  output_attribute: 'rssi'
  default_value: 'UNKNOWN'
  values:
    -100: 'Very Weak'
    -80: 'Weak'
    -60: 'Average'
    -40: 'Strong'
message:
- 'Device address: {device_address}'
- 'Signal strength: {rssi}'
- 'Latitude: {latitude}'
- 'Longitude: {longitude}'
- 'Device name: {device_name}'
- 'First discovery: {first_discovery}'
short_message:
- 'Device address: {device_address}'
- 'Signal strength: {rssi}'
separator: ', '
short_source: 'AirGuard AirTag Tracker'
source: 'AirGuard AirTag Tracker event data.'
---
type: 'conditional'
data_type: 'android:burners'
message:
- 'Phone Number: {phone_number}'
- 'Voice Mail: {voicemail_url}'
- 'User Identifier: {user_identifier}'
- 'Name: {name} '
- 'Alias: {alias}'
- 'Features: {features}'
- 'Total Minutes: {total_minutes}'
short_message:
- 'Phone Number: {phone_number}'
- 'User: {user_identifier}'
short_source: 'SQLITE'
source: 'Android burners database'
---
type: 'conditional'
data_type: 'android:app_usage'
message:
- 'Package: {package}'
- 'Component: {component}'
short_message:
- 'Package: {package}'
- 'Component: {component}'
short_source: 'LOG'
source: 'Android App Usage'
---
type: 'conditional'
data_type: 'android:event:battery'
enumeration_helpers:
- input_attribute: 'charge_type'
  output_attribute: 'charge_type_string'
  default_value: 'UNKNOWN'
  values:
    0: 'not charging'
    1: 'rapid charging'
    2: 'slow charging'
    3: 'wireless charging'
- input_attribute: 'battery_saver'
  output_attribute: 'battery_saver_string'
  default_value: 'UNKNOWN'
  values:
    1: 'on'
    2: 'off'
message:
- 'Battery level: {battery_level}'
- 'Battery saver: {battery_saver_string}'
- 'Charge type: {charge_type_string}'
short_message:
- 'Battery level: {battery_level}'
short_source: 'LOG'
source: 'Android Turbo Battery Events'
---
type: 'conditional'
data_type: 'android:event:call'
enumeration_helpers:
- input_attribute: 'call_type'
  output_attribute: 'call_type'
  default_value: 'UNKNOWN'
  values:
    1: 'INCOMING'
    2: 'OUTGOING'
    3: 'MISSED'
message:
- '{call_type}'
- 'Number: {number}'
- 'Name: {name}'
- 'Duration: {duration} seconds'
short_message:
- '{call_type} Call'
short_source: 'LOG'
source: 'Android Call History'
---
type: 'conditional'
data_type: 'android:files_by_google:record'
enumeration_helpers:
- input_attribute: 'media_type'
  output_attribute: 'media_type'
  values:
    0: 'App/Data'
    1: 'Picture'
    2: 'Audio'
    3: 'Video'
    6: 'Text'
- input_attribute: 'is_hidden'
  output_attribute: 'is_hidden'
  values:
    0: 'Visible'
    1: 'Hidden'
message:
- 'File root path: {root_path}'
- 'File root relative path: {root_relative_path}'
- 'File name: {file_name}'
- 'Media type: {media_type}'
- 'Mime type: {mime_type}'
- 'File visibility: {is_hidden}'
short_message:
- 'File root relative path: {root_relative_path}'
- 'File name: {file_name}'
- 'Mime type: {mime_type}'
- 'File visibility: {is_hidden}'
separator: ', '
short_source: 'Files by Google'
source: 'Files by Google event data.'
---
type: 'conditional'
data_type: 'android:logcat'
message:
- '{message}'
- 'Component Tag: {component_tag}'
- 'PID: {pid}'
- 'Thread: {thread_identifier}'
- 'User identifier: {user_identifier}'
short_message:
- '{message}'
short_source: 'LOG'
source: 'Android logcat'
---
type: 'conditional'
data_type: 'android:messaging:hangouts'
enumeration_helpers:
- input_attribute: 'message_status'
  output_attribute: 'message_status'
  default_value: 'UNKNOWN'
  values:
    0: 'UNREAD'
    4: 'READ'
- input_attribute: 'message_type'
  output_attribute: 'message_type'
  default_value: 'UNKNOWN'
  values:
    1: 'SENT'
    2: 'RECEIVED'
message:
- 'Sender: {sender}'
- 'Body: {body}'
- 'Status: {message_status}'
- 'Type: {message_type}'
short_message:
- '{body}'
short_source: 'HANGOUTS'
source: 'Google Hangouts Message'
---
type: 'conditional'
data_type: 'android:messaging:sms'
enumeration_helpers:
- input_attribute: 'sms_type'
  output_attribute: 'sms_type'
  default_value: 'UNKNOWN'
  values:
    1: 'RECEIVED'
    2: 'SENT'
- input_attribute: 'sms_read'
  output_attribute: 'sms_read'
  default_value: 'UNKNOWN'
  values:
    0: 'UNREAD'
    1: 'READ'
message:
- 'Type: {sms_type}'
- 'Address: {address}'
- 'Status: {sms_read}'
- 'Message: {body}'
short_message:
- '{body}'
short_source: 'LOG'
source: 'Android SMS messages'
---
type: 'conditional'
data_type: 'android:sqlite:app_launch'
message:
- 'Package: {package_name}'
- 'Launch Location Identifier: {launch_location_identifier}'
- 'Prediction UI Surface Identifier: {prediction_ui_surface_identifier}'
- 'Prediction Source Identifier: {prediction_source_identifier}'
- 'Prediction Rank: {prediction_rank}'
short_message:
- 'Package: {package_name}'
- 'Launch Location Identifier: {launch_location_identifier}'
- 'Prediction UI Surface Identifier: {prediction_ui_surface_identifier}'
- 'Prediction Source Identifier: {prediction_source_identifier}'
- 'Prediction Rank: {prediction_rank}'
short_source: 'App Launch'
source: 'Android App launch (Simple Storage)'
---
type: 'conditional'
data_type: 'android:sqlite:app_usage'
message:
- 'Package Name: {package_name}'
short_message:
- 'Package Name: {package_name}'
short_source: 'Android app usage'
source: 'Android SQLite App Usage'
---
type: 'conditional'
data_type: 'android:sqlite:downloads'
enumeration_helpers:
- input_attribute: 'status'
  output_attribute: 'status_string'
  values:
    190: 'STATUS_PENDING'
    192: 'STATUS_RUNNING'
    193: 'STATUS_PAUSED_BY_APP'
    194: 'STATUS_WAITING_TO_RETRY'
    195: 'STATUS_WAITING_FOR_NETWORK'
    196: 'STATUS_QUEUED_FOR_WIFI'
    198: 'STATUS_INSUFFICIENT_SPACE_ERROR'
    199: 'STATUS_DEVICE_NOT_FOUND_ERROR'
    200: 'STATUS_SUCCESS'
    400: 'STATUS_BAD_REQUEST'
    406: 'STATUS_NOT_ACCEPTABLE'
    411: 'STATUS_LENGTH_REQUIRED'
    412: 'STATUS_PRECONDITION_FAILED'
    488: 'STATUS_FILE_ALREADY_EXISTS_ERROR'
    489: 'STATUS_CANNOT_RESUME'
    490: 'STATUS_CANCELED'
    491: 'STATUS_UNKNOWN_ERROR'
    492: 'STATUS_FILE_ERROR'
    493: 'STATUS_UNHANDLED_REDIRECT'
    494: 'STATUS_UNHANDLED_HTTP_CODE'
    495: 'STATUS_HTTP_DATA_ERROR'
    496: 'STATUS_HTTP_EXCEPTION'
    497: 'STATUS_TOO_MANY_REDIRECTS'
    1000: 'ERROR_UNKNOWN'
    1001: 'ERROR_FILE_ERROR'
    1002: 'ERROR_UNHANDLED_HTTP_CODE'
    1004: 'ERROR_HTTP_DATA_ERROR'
    1005: 'ERROR_TOO_MANY_REDIRECTS'
    1007: 'ERROR_DEVICE_NOT_FOUND'
    1008: 'ERROR_CANNOT_RESUME'
    1009: 'ERROR_FILE_ALREADY_EXISTS'
    1010: 'ERROR_BLOCKED'
    1: 'PAUSED_WAITING_TO_RETRY'
    2: 'PAUSED_WAITING_FOR_NETWORK'
    3: 'PAUSED_QUEUED_FOR_WIFI'
    4: 'PAUSED_UNKNOWN'
- input_attribute: 'destination'
  output_attribute: 'destination_string'
  values:
    0: 'DESTINATION_EXTERNAL'
    1: 'DESTINATION_CACHE_PARTITION'
    2: 'DESTINATION_CACHE_PARTITION_PURGEABLE'
    3: 'DESTINATION_CACHE_PARTITION_NOROAMING'
    4: 'DESTINATION_FILE_URI'
    5: 'DESTINATION_SYSTEMCACHE_PARTITION'
    6: 'DESTINATION_NON_DOWNLOADMANAGER_DOWNLOAD'
- input_attribute: 'ui_visibility'
  output_attribute: 'ui_visibility_string'
  values:
    0: 'VISIBILITY_VISIBLE'
    1: 'VISIBILITY_VISIBLE_NOTIFY_COMPLETED'
    2: 'VISIBILITY_HIDDEN'
    3: 'VISIBILITY_VISIBLE_NOTIFY_ONLY_COMPLETION'
message:
- 'Identifier: {identifier}'
- 'URI: {uri}'
- 'MIME Type: {mime_type}'
- 'Total Bytes: {total_bytes}'
- 'Current Bytes: {current_bytes}'
- 'Download Status: {status_string}'
- 'Saved to: {saved_to}'
- 'Is Deleted: {deleted}'
- 'Notification Package: {notification_package}'
- 'Title: {title}'
- 'Media Provider URI: {media_provider_uri}'
- 'Error Msg: {error_msg}'
- 'Is Visible in Downloads UI: {is_visible_in_downloads_ui}'
- 'Destination Type: {destination_string}'
- 'UI Visibility: {ui_visibility_string}'
- 'ETag: {e_tag}'
- 'Description: {description}'
short_message:
- 'URI: {uri}'
- 'Download Status: {status_string}'
short_source: 'Android Native Downloads'
source: 'Android native downloads (downloads.db)'
---
type: 'conditional'
data_type: 'android:tango:contact'
message:
- '{first_name}'
- '{last_name}'
- '{gender}'
- 'birthday: {birthday}'
- 'Status: {status}'
- 'Friend: {is_friend}'
- 'Request type: {friend_request_type}'
- 'Request message: {friend_request_message}'
short_message:
- '{first_name}'
- '{last_name}'
- 'Status: {status}'
short_source: 'Tango Android'
source: 'Tango Android Contact'
---
type: 'conditional'
data_type: 'android:tango:conversation'
message:
- 'Conversation ({conversation_identifier})'
short_message:
- 'Conversation ({conversation_identifier})'
short_source: 'Tango Android'
source: 'Tango Android Conversation'
---
type: 'conditional'
data_type: 'android:tango:message'
enumeration_helpers:
- input_attribute: 'direction'
  output_attribute: 'direction'
  default_value: 'Unknown'
  values:
    1: 'Incoming'
    2: 'Outgoing'
message:
- '{direction}'
- 'Message ({message_identifier})'
short_message:
- '{direction}'
- 'Message ({message_identifier})'
short_source: 'Tango Android'
source: 'Tango Android Message'
---
type: 'conditional'
data_type: 'android:twitter:contact'
message:
- 'Screen name: {username}'
- 'Profile picture URL: {image_url}'
- 'Name: {name}'
- 'Location: {location}'
- 'Description: {description}'
- 'URL: {web_url}'
- 'Number of followers: {followers}'
- 'Number of following: {friend}'
- 'Number of tweets: {statuses}'
short_message:
- 'Screen name: {username}'
- 'Description: {description}'
- 'URL: {web_url}'
short_source: 'Twitter Android'
source: 'Twitter Android Contacts'
---
type: 'conditional'
data_type: 'android:twitter:search'
message:
- 'Name: {name}'
- 'Query: {search_query}'
short_message:
- 'Query: {search_query}'
short_source: 'Twitter Android'
source: 'Twitter Android Search'
---
type: 'conditional'
data_type: 'android:twitter:status'
enumeration_helpers:
- input_attribute: 'favorited'
  output_attribute: 'favorited'
  default_value: 'UNKNOWN'
  values:
    0: 'No'
    1: 'Yes'
- input_attribute: 'retweeted'
  output_attribute: 'retweeted'
  default_value: 'UNKNOWN'
  values:
    0: 'No'
    1: 'Yes'
message:
- 'User: {username}'
- 'Status: {content}'
- 'Favorited: {favorited}'
- 'Retweeted: {retweeted}'
short_message:
- 'User: {username}'
- 'Status: {content}'
short_source: 'Twitter Android'
source: 'Twitter Android Status'
---
type: 'conditional'
data_type: 'android:viber:call'
enumeration_helpers:
- input_attribute: 'call_type'
  output_attribute: 'call_type'
  default_value: 'UNKNOWN'
  values:
    1: 'INCOMING'
    2: 'OUTGOING'
- input_attribute: 'viber_call_type'
  output_attribute: 'viber_call_type'
  default_value: 'UNKNOWN'
  values:
    1: 'AUDIO CALL'
    4: 'VIDEO CALL'
message:
- 'Number: {phone_number}'
- 'Call type: {call_type}'
- 'Viber call type: {viber_call_type}'
- 'Duration: {duration} seconds'
short_message:
- '{phone_number}'
- '{call_type}'
- '{viber_call_type}'
short_source: 'Android Viber'
source: 'Android Viber Call History'
---
type: 'conditional'
data_type: 'android:webview:cookie'
message:
- 'Host: {host}'
- 'Path: {path}'
- 'Cookie name: {name}'
- 'Value: {value}'
- 'Secure: {secure}'
short_message:
- '{host}'
- '{name}'
- '{value}'
short_source: 'WebView'
source: 'Android WebView'
---
type: 'conditional'
data_type: 'android:webviewcache'
message:
- 'URL: {url}'
- 'Content Length: {content_length}'
short_message:
- '{url}'
short_source: 'WebViewCache'
source: 'Android WebViewCache'
