The USERDATA/dalvik-cache directory should be examined for .dex files, .oat files, and .art files. In this directory, you may find both an arm and profiles directory that will contain the files of interest.  The .dex files are compiled Android application code files. The .oat files are optimized .dex files leveraging “ahead-of time” features. This type of file speeds up the application load time.  The .art files are Android Runtime files. Applications that currently exist or existed on the device may leave these files behind. If an application was installed and then deleted, traces may reside in these locations. The USERDATA/system directory contains two files that should be examined for application permissions and application metadata, respectively:

  •  packages.xml

  •  packages.list

Finally, if you want to know who downloaded and installed the application, the com.android.vending/databases/library.db will be helpful.  Make sure to refer to the cheat sheet within your course media files for more locations to examine. There are tons of them!