User Dictionary / Learned Words (user_dict.db)

Location

Description

SQLite database containing words manually added by the user to the keyboard dictionary, as well as words learned through predictive text input. Each entry includes the word, its frequency or weight, locale setting, and an optional shortcut for text expansion.

Forensic Value

The user dictionary reveals terms, names, slang, and codes that the device user typed frequently enough for the keyboard to learn or that were manually added for convenience. This artifact can expose uncommon names, addresses, drug terminology, foreign language terms, or code words that do not appear in standard dictionaries. Learned words persist even after the original messages or applications containing them are deleted, providing a residual indicator of communication content that no longer exists on the device.

Tools Required

Collection Commands

adb pull /data/data/com.android.providers.userdictionary/databases/user_dict.db /forensics/output/

python3 aleapp.py -t tar -i /path/to/extraction -o /forensics/output/

adb shell content query --uri content://user_dictionary/words > user_dict_dump.txt

Collection Constraints

• •Availability depends on Android version, OEM build, encryption state, privilege level, and whether the collection was logical, rooted, or full-filesystem. OEM-specific builds may move or rename stores.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References