I have a Samsung Galaxy SM G970F phone that had a cellebrite report prepared. The report showed a series of images of interest that were listed as com.sec.android.gallery3d/cache files. My understanding is that these thumbnail images indicate the images were once in the Gallery app, possibly since deleted, and the thumbs were created to allow fast loading to the app.
I have a couple of questions
*Can it be said the image files indicate the images were clicked on/downloaded from a website and placed into the gallery?
**If so, would this be a deliberate action or could some websites download images into the gallery app without the knowledge of the user?
***What is the significance that these images are not in a cache folder from a browser? (e.g. com.android.chrome/cache)
Many thanks for your assistance!
See the following Forensic Focus post https://www.forensicfocus.com/Forums/viewtopic/t=10919/postdays=0/postorder=asc/start=0/ and then check out the following blog http//
Having tested the Gallery3d app before on many cases (albeit years ago), I know different versions can work slightly different, therefore its best to test it yourself. However, in general they are created by the OS, without the users knowledge to speed up image loading and user experience. They are not cached images from web browsing. As far as the user is concerned, once they have deleted the original image, its gone. However, unbeknownst to them, Gallery3d can retain cached versions even after originals have been deleted. We used to find illegal images all the time in Gallery3d, but not the original images on devices, therefore was indicative the originals had been deleted. The user would be able to locate imgcache.0 files etc in their file system, however unless they carved images out (unlikely for Joe Bloggs) the average user would not know what it is or be able to access the cache versions.
I have a Samsung Galaxy SM G970F phone that had a cellebrite report prepared. The report showed a series of images of interest that were listed as com.sec.android.gallery3d/cache files. My understanding is that these thumbnail images indicate the images were once in the Gallery app, possibly since deleted, and the thumbs were created to allow fast loading to the app.
I have a couple of questions
*Can it be said the image files indicate the images were clicked on/downloaded from a website and placed into the gallery?
**If so, would this be a deliberate action or could some websites download images into the gallery app without the knowledge of the user?
***What is the significance that these images are not in a cache folder from a browser? (e.g. com.android.chrome/cache)Many thanks for your assistance!
If I could put the pic up here I could show you the 'notification tab' with all my email etc. in the drop-down home screen.
I get it on my Samsung tablet that set off a FireFox Monitor "I've been pawned" alert since after a week of seeing it when I accidentally tapped it.
It has the square yellow Gallery emblem with a flower (top line) & "Sign-in Request" with my email address.Â
under the "sign -in request".
Then to the right is a /!\Â below the time 15:28 above it.
If you see & accidentally tap it you hooked!
Now I have to change all my log-ins to a new user email & password.
What a pain!