01Location
- /data/data/com.android.providers.contacts/databases/contacts2.db
- /data/data/com.samsung.android.providers.contacts/databases/contacts2.db (Samsung)
02Questions it answers
- Which names, numbers and email addresses were stored on the device?
- Which account (local or synced) did each raw contact come from?
- When was a contact last updated, and which contacts were deleted recently?
03Format and versions
| Format | SQLite database created by ContactsDatabaseHelper (DATABASE_NAME "contacts2.db"). Core tables: raw_contacts, contacts, data, mimetypes, accounts and deleted_contacts; the provider also defines views such as view_data. |
|---|---|
| Applies to | AOSP ContactsProvider; CONTACT_LAST_UPDATED_TIMESTAMP was added in API level 18. On releases before calllog.db existed the calls table was also stored here. |
04Key fields
| Field | What it tells you |
|---|---|
| raw_contacts | One row per contact per account; account_id references accounts; deleted is 1 if the row is marked for deletion. |
| contacts | Aggregated contact; raw_contacts.contact_id points to contacts._id. |
| data + mimetypes | Typed values (data1 …) for each raw contact; the mimetype tells the kind, e.g. vnd.android.cursor.item/phone_v2 or email_v2. |
| deleted_contacts | Log of deleted contacts: contact_id and contact_deleted_timestamp. |
| accounts | Accounts that own raw contacts. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| contacts.contact_last_updated_timestamp | Unix epoch, milliseconds | When the contact was last updated. |
| deleted_contacts.contact_deleted_timestamp | Unix epoch, milliseconds | When the contact was deleted; entries older than DAYS_KEPT_MILLISECONDS (2,592,000,000 ms = 30 days) may be removed. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Acquire contacts2.db with its journal/WAL files and note the provider package (AOSP or vendor).
- Join raw_contacts → contacts and data → mimetypes to list values with their type.
- Attribute each raw contact to its account through accounts.
- Review deleted_contacts and raw_contacts.deleted for recent removals.
- Use the result to label numbers in call, SMS and app records.
07Interpretation pitfalls
- A stored contact does not show that any communication took place.
- Contacts that arrive through a synced account were not necessarily created on this device.
- The deleted-contacts log is pruned; absence of an entry is not proof that nothing was deleted.
09Sources
- AOSP — ContactsDatabaseHelper.java Android Open Source Project (GitHub mirror) · checked 2026-10-14
- ContactsContract.RawContacts — API reference Android Developers · checked 2026-10-14
- ContactsContract.DeletedContacts — API reference Android Developers · checked 2026-10-14
- ContactsContract.ContactsColumns — API reference Android Developers · checked 2026-10-14
- ALEAPP — scripts/artifacts/contacts.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14