±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 121

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

How to tell a video was viewed on Android device?

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

giuseppem
Member
 

How to tell a video was viewed on Android device?

Post Posted: Oct 28, 17 10:24

Hello!

I performed a physical acquisition of an Android device. Now, I need to know if a video was viewed from the person investigated. I used Physical Analyzer, so I have a report. In the video section, in the file's metadata, I have these dates:

Creation time: 05/04/2017 00:01:35(UTC+0)
Modify time: 05/04/2017 00:01:36(UTC+0)
Last access time: 05/04/2017 00:01:35(UTC+0)

What do you think about it? Do I need some more informations (e.g.: opened recent files)?

Thank you so much  
 
  

athulin
Senior Member
 

Re: How to tell a video was viewed on Android device?

Post Posted: Oct 28, 17 19:03

- giuseppem
What do you think about it? Do I need some more informations (e.g.: opened recent files)?


Generally, you need to

a) know what the video-viewing app is (or was), and

b) have comprehensive test results from all conceivable use cases of that app, and how they affect time stamping, as well as

c) know how other operations may affect those time stamps as well.

It's not enough to know 'this is what happens when I view a film', even if it matches what you find. You need to know all other ways that result could also come about, assuming you want to do a decent job. Do the time stamps also change if you open the video, but don't start playing it? Is the film of an SD card, that could have been last read/written on another computer? Or ... and so on.

If you're able to show that some particular app was the last thing that affected the time stamps, you may have something.  
 
  

giuseppem
Member
 

Re: How to tell a video was viewed on Android device?

Post Posted: Oct 29, 17 07:17

Thank you athulin.

This video, I know for sure, was received from Messenger app (the Facebook chat). So the metadata have a sense. They are compatible with a media downloaded (received), but there is that difference of 1 second, in the "modify time", that let me think..  
 

Page 1 of 1