Notifications
Clear all
Topic starter
13/05/2016 4:43 am
Hi.
I am busy with an investigation and need to proof that the user logged into Gmail and the “Stay signed in” was selected. The computer was shutdown and started afterwards and the Gmail account was accessed without a password.
I need to proof that the Gmail account was accessed with auto login (no password). The browser used was Chrome on a Windows 7 PC.
I tested this option on my live system and selected the “Stay sign in” option. The RMME field (accounts.google.com) in the cookies db was updated from false to true. Chrome uses a SQL db for its cookies and I could not found any RMME fields on the subject’s PC.
Can anyone advice me of a way forward in such matter.
Thanks