±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35503
New Yesterday: 0 Visitors: 105

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Android email cache

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

ThePM
Senior Member
 

Android email cache

Post Posted: Mar 02, 18 16:23

Hi guys,

On the physical extraction of a Samsung SM-G800H, I found some files that are pertinent to my investigation under the following folder:
/userdata/media/0/Android/data/com.android.email/cache
My problem is that I cannot figure out they got there.

Since it's the email app cache folder, my first guess was that it was an attachment to an email, but I can't find any reference to the file name when I perform an hex search on the EmailProvider.db or the EmailProviderBody.db databases.

When I search for the file names in autopsy after loading the user partition, the only hits I get are the files found in the cache folder.

I guess this could be because the emails were deleted...

Could there be other reasons why files would get into that folder?

I don't have a test Android so I can't really test stuff out.

Any help would be appreciated.

Thank you.  
 

Page 1 of 1