Hi guys,
On the physical extraction of a Samsung SM-G800H, I found some files that are pertinent to my investigation under the following folder
/userdata/media/0/Android/data/com.android.email/cache
My problem is that I cannot figure out they got there.
Since it's the email app cache folder, my first guess was that it was an attachment to an email, but I can't find any reference to the file name when I perform an hex search on the EmailProvider.db or the EmailProviderBody.db databases.
When I search for the file names in autopsy after loading the user partition, the only hits I get are the files found in the cache folder.
I guess this could be because the emails were deleted…
Could there be other reasons why files would get into that folder?
I don't have a test Android so I can't really test stuff out.
Any help would be appreciated.
Thank you.