I'm working on a case where it might be of interest if the suspect did open certain apps on the victims tablet and read its content, for example chat dialogues from the Facebook messenger app.
Is it possible to determine this by analyzing log files on the device? The device is an Samsung Tablet running Android 5.0.2. It's not possible yet with UFED to get a physical dump, but maybe I could root the device to get it.
So assuming I have a physical dump of an Android 5 device, are there any logs on it, which could indicate when an an app was opened? Or when the screen was unlocked?
Anything? lol
I sent you a PM with some ideas.
Any chance you can share the information you found with me aeiforeniscs an Sam Brown?
Thank you )
I don't know about logs in Android showing when a screen was unlocked. If there are logs about this, I would also be interested to know about them.
With started apps direct logs or system logs could exist (or not )). All apps with automatic updates check on startup might be logged somewhere, even if the app itself doesn't have logging.
Stop responding to a bot
@Forhad stop answering posts with misleading answers! This forum is mostly about forensics and a bit about data recovery, not about backyard garage testings.
Altering the tablet data content in any way would make the evidence void!