I‘m working on a case where Google reported videofiles containing csa-content to NCMEC.
During investigation of the seized device I found the filenames of the reported videofiles in „cello.db“ located at:
data\data\com.google.android.apps.docs\app_cello\<ACCOUNT_NAME>\cello.db
This database refers to Google Docs. As I know, Google Docs displays only documents (except media embedded in documents). The question is now: How or why does a videofile generate an entry in the cello.db? If the media was embedded in a document I would expect to find only the document in cello.db?
Navigating on the cloud to a folder containing only media files with Google Docs results in an empty folder.
Anybody an idea?
Thanks!
Just in case somone else came across the same question, I found the solution:
"com.google.android.apps.docs" does not refeer only to "Google Docs" but also to "Google Drive". Thats it!