The localappstate.db contains information relating to the applications installed, how they were downloaded (delivered to the device), dates and times of interest, and more. When considering if a user intentionally removed and reinstalled an application, the dates and times can be used to help your examination. If the delivery date is after the first download date, it may have been deleted and reinstalled.

A query that may help you handle this database is shared below. As always, modify these queries to work for you and your investigation. NOTE: The delivery data column of the appstate table contains blob data that pertains to the download. (Where did the download come from, and how was it delivered to the device?) This file is located at USERDATA/data/com.android.vending/databases/localappstate.db.

SELECT

package_name,

auto_update As "1=AutoUpdate Set",

delivery_data,

DateTime(delivery_data_timestamp_ms / 1000, 'UNIXEPOCH') As "Delivery Date",

DateTime(first_download_ms / 1000, 'UNIXEPOCH') As "First Download Date",

account,

title,

last_notified_version,

datetime(last_update_timestamp_ms/ 1000, 'UNIXEPOCH') As "Last Update",

datetime(install_request_timestamp_ms/ 1000, 'UNIXEPOCH') As "Install Request Date"

From appstate