Samsung Android Gallery-Deleted Photos

 Samsung Android Deleted Gallery

-Starting in Android 9, the user has the capability to restore deleted media files.

-When a user deletes a media file, the media file is not immediately deleted.

-It goes into trash and remains in the trash for 30 days.

-The filename is changed upon deletion.

-During this time the user can choose to permanently delete the file or restore it to its original

location.

-The deleted file specific to a Samsung device, will be parsed with forensic tools from:

data\media\0\Android\data\com.sec.android.gallery3d\files\.Trash

-Data about the file can be located in: data\data\com.sec.android.gallery3d\databases\local.db.

-Looking in the local.db specifically, the trash table, contains information about the deleted

media file.



-The following columns contain data about the deleted files:

         _absPath – The current path of the deleted file.

         _Title – The current title of the deleted file.

         _width, _height, _orientation.

         _originPath – The original path that the file was deleted from.

         _originTitle – The original title of the deleted file.

         deleteTime – The date/time that the file was deleted.

         _restoreExtra – Additional data about the file in a JSON format. This includes _date

            taken and _relativePath.

         _expiredPeriod – The retention time related to the file once it is sent to the trash.

**Note** This research is specific to Samsung devices.

Deleted Gallery for other Android devices may be slightly different.

Popular posts from this blog

Snapchat Artifacts

Image
iOS Snapchat -user.plist- - fs-full.zip/private/var/mobile/Containers/Data/Application/****Snapchat application ID**** /Documents/user.plist -holds data about the local user such as username and user id. -primary.docobjects database- - fs-full.zip/private/var/mobile/Containers/Data/Application/****Snapchat application ID**** /Documents/user_scoped/9ea0aafe276d670e1a5155f78ee18485aca8b9040982e579eef26be6bb39 ad94/DocObjects/primary.docobjects -Snapchat contacts can be found in this database -Arroyo.db -fs-full.zip/private/var/mobile/Containers/Data/Application//****Snapchat application ID**** /Documents/user_scoped/9ea0aafe276d670e1a5155f78ee18485aca8b9040982e579eef26be6bb39 ad94/arroyo/arroyo.db          - The message content is stored in the conversation_message table.          - Each conversation has a client_conversation_id.          - The message is located in the message_content column.      ...
Read more

Google Keep Notes

Image
___________Google Keep Notes_______________________________________ While working on a case recently, I came across the Google Keep Notes application installed and utilized on an Android mobile device. Both of the commercial parsing tools that I was using to analyze the data displayed the timestamps of the notes and the title of the notes but no note body was present in the parsed data.   So, I just check marked everything in the case created a Reader/Portable Case, and sent the data out. Because if the tool doesn’t parse it, it doesn’t exist, right? Wrong.   I followed the source file which is a SQLite database named keep.db. Inside of the database is a ton of additional data including the body of those notes!   How Google Keep Notes Work: Google Keep boasts the capability to add notes lists and photos to Google Keep. They have the capability to record a voice memo and Keep will transcribe it so you can find it later. The Google Keep notes are share...
Read more