From TikTok to RedNote: A Comprehensive Mobile Forensic and Security Analysis on Android

RedNote, known in China as Xiaohongshu, has gained substantial traction in the US market following Tik-Tok's recent restrictions. To address the forensics gap of this app, this paper presents a comprehensive forensic analysis of the latest RedN ote version on an Android device. The study involves populating a Google Pixel 5a with typical user data, followed by the image acquisition and detailed examination using Magnet AXIOM, and validation with ALEAPP. In parallel, a static analysis of the RedN ote APK was conducted using the Mobile Security Framework (MobSF) to identify potentially risky permissions, cryptographic weaknesses, and insecure configurations. Our research identifies and analyzes various types of user data, including account information, interaction records, content browsing and posting. We also delve into the app's folder structure and data storage paths, highlighting the forensic value of this recently popular application, which poses unique challenges due to its non-international development and singular APK release across regions.