In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get:
[fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, neither datr, nor lu, etc. at some offset of the file, there are these strings. Could they be the active Facebook session that was open at the last use of the cell phone? How do I know the length of the fields in order to inject the cookies in a web browser and hijack the session?
[webview.db] This database does contain a table cookies and some records in it, that are: "datr" and "lu". I tried to inject these two cookies in my web browser but couldn't get logged into my account.
I'm planning to dump all records in a format that can be imported into Firefox's Cookie Manager and see if that works.
The main question would be: Is it possible to use that information the same way one could capture live traffic and extract and then inject cookies sent within the LAN to Facebook servers? If so, what cookies or information I'm missing?