±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 2 Visitors: 182

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Android email cache

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Android email cache

Post Posted: Mar 02, 18 16:23

Hi guys,

On the physical extraction of a Samsung SM-G800H, I found some files that are pertinent to my investigation under the following folder:
My problem is that I cannot figure out they got there.

Since it's the email app cache folder, my first guess was that it was an attachment to an email, but I can't find any reference to the file name when I perform an hex search on the EmailProvider.db or the EmailProviderBody.db databases.

When I search for the file names in autopsy after loading the user partition, the only hits I get are the files found in the cache folder.

I guess this could be because the emails were deleted...

Could there be other reasons why files would get into that folder?

I don't have a test Android so I can't really test stuff out.

Any help would be appreciated.

Thank you.  

Page 1 of 1