Notifications
Clear all

Android email cache

1 Posts
1 Users
0 Likes
757 Views
(@thepm)
Posts: 253
Reputable Member
Topic starter
 

Hi guys,

On the physical extraction of a Samsung SM-G800H, I found some files that are pertinent to my investigation under the following folder
/userdata/media/0/Android/data/com.android.email/cache
My problem is that I cannot figure out they got there.

Since it's the email app cache folder, my first guess was that it was an attachment to an email, but I can't find any reference to the file name when I perform an hex search on the EmailProvider.db or the EmailProviderBody.db databases.

When I search for the file names in autopsy after loading the user partition, the only hits I get are the files found in the cache folder.

I guess this could be because the emails were deleted…

Could there be other reasons why files would get into that folder?

I don't have a test Android so I can't really test stuff out.

Any help would be appreciated.

Thank you.

 
Posted : 02/03/2018 3:23 pm
Share: