I am working on a LG-P509 (Tmobile) that I was able to collect data from the phone using Cellebrite (Logical Only) I used Encase to examine the SD card that was in the phone.
I located an image file that I am trying to come up with a good reason for its location and naming structure. Encase shows the image to be a Jpeg. The file path for the picture is
C\Android\data\com.cooliris.media\cache\hires-image-cache\4669560605797046177_1024.cache
This is the only copy of the picture that I can fine on either the phone or the SD card. The owner of the phone reports taking the picture and sending it out as an attachment to a text message….The suspect was not asked what he used to send the picture out and if he deleted the original.
I think I am seeing a temporary file generated as a result of the attachment of the image to a text message. Does anyone have any thoughts on the picture and its location?
Have you tried doing a search for 4669560605797046177_1024.cache to see if there are any other references to the image name and thus its origin? Perhaps a sqlite database
I am working on a LG-P509 (Tmobile) that I was able to collect data from the phone using Cellebrite (Logical Only) I used Encase to examine the SD card that was in the phone.
I located an image file that I am trying to come up with a good reason for its location and naming structure. Encase shows the image to be a Jpeg. The file path for the picture is
C\Android\data\com.cooliris.media\cache\hires-image-cache\4669560605797046177_1024.cache
This is the only copy of the picture that I can fine on either the phone or the SD card. The owner of the phone reports taking the picture and sending it out as an attachment to a text message….The suspect was not asked what he used to send the picture out and if he deleted the original.
I think I am seeing a temporary file generated as a result of the attachment of the image to a text message. Does anyone have any thoughts on the picture and its location?
com.cooliris.media is the package name for the Gallery app that you see on Android phones. (the one with the 3d scrolling effect)
the file is a cached thumb from that.
http//
Thank you. That was exactly what I was looking for