Insecure Data Storage on Android

Most mobile findings are not clever — they are an app writing a session token, a password, or a card number to disk in cleartext and trusting nobody will read it. Pull the app sandbox off a rooted phone or an adb backup and it is all there. Exactly where Android apps store data (SharedPreferences, SQLite, internal vs external), how to extract and read it on your own test device, the patterns that keep showing up, and how to store secrets so a stolen phone is worthless.