Android email cache
Clear all

Android email cache  

Active Member

Hi guys,

On the physical extraction of a Samsung SM-G800H, I found some files that are pertinent to my investigation under the following folder
My problem is that I cannot figure out they got there.

Since it's the email app cache folder, my first guess was that it was an attachment to an email, but I can't find any reference to the file name when I perform an hex search on the EmailProvider.db or the EmailProviderBody.db databases.

When I search for the file names in autopsy after loading the user partition, the only hits I get are the files found in the cache folder.

I guess this could be because the emails were deleted…

Could there be other reasons why files would get into that folder?

I don't have a test Android so I can't really test stuff out.

Any help would be appreciated.

Thank you.

Posted : 02/03/2018 3:23 pm