How to tell a video...
 
Notifications
Clear all

How to tell a video was viewed on Android device?

3 Posts
2 Users
0 Likes
514 Views
(@giuseppem)
Posts: 24
Eminent Member
Topic starter
 

Hello!

I performed a physical acquisition of an Android device. Now, I need to know if a video was viewed from the person investigated. I used Physical Analyzer, so I have a report. In the video section, in the file's metadata, I have these dates

Creation time 05/04/2017 000135(UTC+0)
Modify time 05/04/2017 000136(UTC+0)
Last access time 05/04/2017 000135(UTC+0)

What do you think about it? Do I need some more informations (e.g. opened recent files)?

Thank you so much

 
Posted : 28/10/2017 10:24 am
(@athulin)
Posts: 1156
Noble Member
 

What do you think about it? Do I need some more informations (e.g. opened recent files)?

Generally, you need to

a) know what the video-viewing app is (or was), and

b) have comprehensive test results from all conceivable use cases of that app, and how they affect time stamping, as well as

c) know how other operations may affect those time stamps as well.

It's not enough to know 'this is what happens when I view a film', even if it matches what you find. You need to know all other ways that result could also come about, assuming you want to do a decent job. Do the time stamps also change if you open the video, but don't start playing it? Is the film of an SD card, that could have been last read/written on another computer? Or … and so on.

If you're able to show that some particular app was the last thing that affected the time stamps, you may have something.

 
Posted : 28/10/2017 7:03 pm
(@giuseppem)
Posts: 24
Eminent Member
Topic starter
 

Thank you athulin.

This video, I know for sure, was received from Messenger app (the Facebook chat). So the metadata have a sense. They are compatible with a media downloaded (received), but there is that difference of 1 second, in the "modify time", that let me think..

 
Posted : 29/10/2017 7:17 am
Share: