01Location
- /data/misc/wifi/WifiConfigStore.xml (shared store, Android 10)
- /data/misc_ce/<userId>/wifi/ (user store files, Android 10)
- /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml (Wi-Fi module layout searched by ALEAPP)
- WifiConfigStoreSoftAp.xml, WifiConfigStoreNetworkSuggestions.xml (other store files)
02Questions it answers
- Which Wi-Fi networks were saved on the device?
- What security mode did each network use?
- Is a gateway MAC address recorded that can be correlated with other evidence?
03Format and versions
| Format | XML written by WifiConfigStore; each saved profile is a <Network> element whose children carry name attributes such as ConfigKey, SSID, PreSharedKey and DefaultGwMacAddress. |
|---|---|
| Applies to | The Wi-Fi mainline module (com.android.wifi) is available on Android 11+. In Android 10 shared store files were in /data/misc/wifi and user store files in /data/misc_ce/<userId>/wifi; upgrading devices convert vendor formats through WifiMigration. |
04Key fields
| Field | What it tells you |
|---|---|
| ConfigKey | Profile key combining SSID and security type; ALEAPP derives the security mode from it. |
| SSID | Network name, stored in quotes. |
| PreSharedKey / WEPKeys / Password / Identity | Stored credentials for the profile; sensitive material. |
| DefaultGwMacAddress | Reported as stored; AOSP documents the WifiConfiguration field as the default gateway MAC address if known, but the name mapping was not traced by ALEAPP. |
| CaptivePortal / LoginUrl / IpAssignment | Captive-portal flag, portal URL and IP assignment mode. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| semCreationTime / semUpdateTime | Unix epoch, milliseconds | Samsung-specific fields where present. |
| LastConnectedTime | Unix epoch, milliseconds | Parsed by ALEAPP where present; not in every build. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Locate every WifiConfigStore*.xml in both legacy and module paths.
- Parse each <Network> element independently so values do not carry over between profiles.
- Record vendor-specific elements separately from AOSP ones.
- Restrict access to credential fields in reports.
- Correlate SSIDs with connection events in other logs.
07Interpretation pitfalls
- A saved profile shows configuration, not that the device was connected at a given time.
- Profiles can arrive through migration or vendor conversion; their origin may not be this handset.
09Sources
- ALEAPP — scripts/artifacts/wifiProfiles.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- Wi-Fi (modular system component) Android Open Source Project · checked 2026-10-14
- AOSP — WifiConfigStore.java (android-14.0.0_r1) Android Open Source Project · checked 2026-10-14