Area 07
Browsers & Media
Mobile browsers use the same SQLite formats as their desktop versions, inside the app sandbox. This area covers Chrome and Samsung Internet history, downloads and search terms, tab state, and the media side of the device: the DCIM camera roll, EXIF metadata, the MediaStore database and thumbnail caches that outlive deleted pictures.
Key artifacts
- app_chrome/Default/History
- Samsung Internet
- DCIM
- external.db
Artifacts in this area
- Chrome on Android: the History Database
Chrome's History SQLite database on Android: visited URLs, per-visit transitions, downloads and search terms, WebKit timestamps, synced visits and retention.
Android 8-16
- Samsung Internet History on Android
Samsung Internet on Android: the Chromium History database, downloads and search terms, Samsung's own tab and bookmark stores, and Secret mode limits.
Android 8-16
- DCIM, EXIF and MediaStore external.db on Android
Android photos and videos as evidence: DCIM naming, EXIF time and GPS, the MediaStore external.db index, owner package, trash and thumbnail caches.
Android 8-16
Guides in this area
No guides yet.
All areas