I am working a case with a SM-B311V Gusto 3 phone, where the guy stated he accessed inappropriate websites. Cellebrite was able to extract a physical of the device. However, PA did not parse out any internet history. A few of the images on the device could be indicative of internet activity, but more then likely they are just images from games he downloaded. IEF did not give me any internet history either. I have searched the interwebs and cannot find any listed files for the BREW OS which would hold internet history. I did a manual examination of many of the files and found some internet references, but nothing that appeared to be actual saved/deleted internet history. A manual inspection of the phone revealed NO internet history on the device, so I would be looking for deleted historical links. Personally, I don't think this was the phone he used to access the websites, but I am trying to rule it out completely. I was told FinalMobile is a great resource for parsing out data from the Brew OS, but I don't presently have this software. I have reached out to them for a trial version, but this case will be done before that is finalized. So I thought I would reach out to see if anyone had any ideas where internet history files are saved in the Brew OS.
Thanks,
Steve
Hey Steve,
IEF should have given you a ton of URLs even if it couldn't figure out the specific browser history. Check the "Potential Browsing Activity" artifact or any of the refined results, you should still get the URLs as we'll carve/regex them from anywhere (especially if you got a physical image).
If you're still not getting the URLs you want there, my guess is your gut is correct and they may have used another device.
Jamie McQuaid
Magnet Forensics
Hey Steve,
IEF should have given you a ton of URLs even if it couldn't figure out the specific browser history. Check the "Potential Browsing Activity" artifact or any of the refined results, you should still get the URLs as we'll carve/regex them from anywhere (especially if you got a physical image).
If you're still not getting the URLs you want there, my guess is your gut is correct and they may have used another device.
Jamie McQuaid
Magnet Forensics
Thanks for the response Jamie. IEF did uncover 7 links under Potential Browsing activity. They all appeared to be links from the manufacturer, as they weren't user friendly links. I feel safe in letting the investigator know that he didn't use this phone to access the internet.
Thanks!!!