In a rooted Android (via imaged and entered into FTK), does anyone know where or if there is a folder containing the internet history/deleted internet history?
mrpumba,
Check the folder labelled 'com.android.browser'. The files of relevance you are looking for should be in there. 'browser.db' should hold the bookmarks, internet history and search history. 'webview.db' also holds cookies, form data and website passwords.
If you have Oxygen or XRY to hand, you can also analyse the handset using them and they should give you internet history and web browser bookmarks.
Hope that helps!
A couple of other points to consider
If you're inspecting the browser.db or browser2.db databases the "bookmarks" table is a bit of a misnomer as it contains your history too - there's a "bookmark" field which is set to 1 if the user has bookmarked the site, otherwise it's history entries.
A favourite of mine is the "formurl" table in the webview.db file - contains urls of pages visited which contained forms (I think they get stored even if they were hidden forms). What's neat here is that the user has to explicitly elect to clear the "form" history - the table stays populated if they only clear the "normal" history.
If you have an actual image of the flash, a combination of how SQLite works and the retentive nature of YAFFS means that you can almost certainly pull out extra/deleted entries from unallocated too.
One thing to remember here is that the user doesn't have to use the default, built-in browser, so make sure you check for other browsers present on the device.
Hope that's of some use
Fantastic thanks guys, I'll check it out and see what I get.
Logan and Alexc,
I looked through the file structure but could not fine the internet history. Where is the browser.db files ?
should be data/data/com.android.browser/databases