Dear all.
I have a job on a Samsung S7 edge running Android 8. The person has over 3000 image files in the following location:
data\com.facebook.orca\cache\image.stash\1
they are a mix of gifs, avatars, general icons, family photographs, adult porn and IIOC images.
I have tried to find out what the image.stash bucket of images mean. so far my research has come up blank. have the images in this folder been sent or received via messenger or are they just general images.
As ORCA deals with the messenger app I assume that they are part of message threads... but I can't seem to tie them to any message threads in the databases I have found.
I am relatively new to phones - normally work on computer jobs... I am using Magnet AXIOM and UFED PA.
any helpful pointers would be awesome - thank you..
Mark Boast
Suffolk DFU
I suggest analyzing each SQLite database file stored within the com.facebook.orca folder to see if you can connect the file names and/or unique document IDs for each image file stored in the image.stash\1 folder.
SQLite database file(s) should hold evidence of human activity related to accessing and downloading each image by date and time.
