Analyzing Android L...
 
Notifications
Clear all

Analyzing Android Log Files

6 Posts
5 Users
0 Likes
978 Views
SamBrown
(@sambrown)
Posts: 97
Trusted Member
Topic starter
 

I'm working on a case where it might be of interest if the suspect did open certain apps on the victims tablet and read its content, for example chat dialogues from the Facebook messenger app.

Is it possible to determine this by analyzing log files on the device? The device is an Samsung Tablet running Android 5.0.2. It's not possible yet with UFED to get a physical dump, but maybe I could root the device to get it.

So assuming I have a physical dump of an Android 5 device, are there any logs on it, which could indicate when an an app was opened? Or when the screen was unlocked?

 
Posted : 10/01/2016 2:58 pm
SamBrown
(@sambrown)
Posts: 97
Trusted Member
Topic starter
 

Anything? lol

 
Posted : 25/01/2016 1:29 pm
aeiforensics
(@aeiforensics)
Posts: 27
Eminent Member
 

I sent you a PM with some ideas.

 
Posted : 25/01/2016 11:04 pm
(@kmolden)
Posts: 3
New Member
 

Any chance you can share the information you found with me aeiforeniscs an Sam Brown?

Thank you )

 
Posted : 07/12/2016 2:21 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

I don't know about logs in Android showing when a screen was unlocked. If there are logs about this, I would also be interested to know about them.

With started apps direct logs or system logs could exist (or not )). All apps with automatic updates check on startup might be logged somewhere, even if the app itself doesn't have logging.

 
Posted : 07/12/2016 3:32 pm
(@armresl)
Posts: 1011
Noble Member
 

Stop responding to a bot

@Forhad stop answering posts with misleading answers! This forum is mostly about forensics and a bit about data recovery, not about backyard garage testings.

Altering the tablet data content in any way would make the evidence void!

 
Posted : 24/12/2016 2:05 am
Share: