Hi,
Long story short. I have some deleted internet history (Chrome on Android phone) but how can I prove the user has deleted it and what date he deleted it and another auto process hasnt deleted it? Another sub question …. how do I know the url's on his phone are not sync'd from another device?
I'm guessing there is a .DB somewhere on the phone that tracks sync'd url's? I only have a phone to work with and no other assumed devices.
I've used Ufed to get a read off the phone and have IEF at my disposal as well as SQL tools.
Thanks
Your help will be greatly appreciated please, if anyone can give me a pointer or 2.
Thanks
M











