How to tell a video...
 
Notifications
Clear all

How to tell a video was viewed on Android device?  

  RSS
giuseppem
(@giuseppem)
New Member

Hello!

I performed a physical acquisition of an Android device. Now, I need to know if a video was viewed from the person investigated. I used Physical Analyzer, so I have a report. In the video section, in the file's metadata, I have these dates

Creation time 05/04/2017 000135(UTC+0)
Modify time 05/04/2017 000136(UTC+0)
Last access time 05/04/2017 000135(UTC+0)

What do you think about it? Do I need some more informations (e.g. opened recent files)?

Thank you so much

Quote
Posted : 28/10/2017 11:24 am
athulin
(@athulin)
Community Legend

What do you think about it? Do I need some more informations (e.g. opened recent files)?

Generally, you need to

a) know what the video-viewing app is (or was), and

b) have comprehensive test results from all conceivable use cases of that app, and how they affect time stamping, as well as

c) know how other operations may affect those time stamps as well.

It's not enough to know 'this is what happens when I view a film', even if it matches what you find. You need to know all other ways that result could also come about, assuming you want to do a decent job. Do the time stamps also change if you open the video, but don't start playing it? Is the film of an SD card, that could have been last read/written on another computer? Or … and so on.

If you're able to show that some particular app was the last thing that affected the time stamps, you may have something.

ReplyQuote
Posted : 28/10/2017 8:03 pm
giuseppem
(@giuseppem)
New Member

Thank you athulin.

This video, I know for sure, was received from Messenger app (the Facebook chat). So the metadata have a sense. They are compatible with a media downloaded (received), but there is that difference of 1 second, in the "modify time", that let me think..

ReplyQuote
Posted : 29/10/2017 7:17 am
Share: