I will preface this by stating I have searched the forum and performed some Googling to try and find this answer, but came up empty. So I thought I would reach out to you all.
Sorry for a simple question here, but I am writing up a report on an exploitation case where the images were all found in Chrome cache and want to make sure I use the proper technical term for an item. My question is if something is a file or a folder?
Physical Analyzer (6.3.11.36) does not show a time/date stamp with these images found in the chrome's cache/Cache/ folder. However, if I go to the file within the File System folder structure, the parent object shows a time and date.
For example, file -Linux native partition (ExtX)/Root/data/com.android.chrome/cache/Cache/00a7c13c0d923091_0/00a7c13c0d923091_0_embedded_1.jpg shows no time or date. In the file System, the folder which contains this jpg, -Linux native partition (ExtX)/Root/data/com.android.chrome/cache/Cache/00a7c13c0d923091_0/, does contain a time date stamp, which corresponds to appropriate web history.
so is the parent object, in this case /00a7c13c0d923091_0/, a folder or a file with the embedded image,00a7c13c0d923091_0_embedded_1.jpg, in it? Or am I way off all together?
Thanks for your assistance.