PayPal has seemingly followed the lead or perhaps started the trend seen amongst other mobile banking applications. While some references to the account owner are still contained in a plist file on iOS devices, many pertinent details are not included in this application repository any longer.

There seemed to be very little data available from a physical or FFS dump from an Android device and obtaining relevant artifacts from application snapshots is also unviable due to the application utilizing a splash screen the application is pushed to the background. One thing that it is important to note about any of these baking applications, is that if a user decides to allow the application to send Notifications to the device, there is more chance of recovering details regarding payments, purchases and transactions. These same details are also often delivered to the user in email messages as well, so it’s important to look for evidence of transactions outside of the application directory itself.

In the example pictured above, access to the full filesystem of an Android device was available, however searches for payment activity based on what was available via the device interface were unsuccessful. These payment details could also be recovered from email messages depending how PayPal was configured.