Information Technology Reference
In-Depth Information
5 files pulled. 0 files skipped.
51 KB/s (160951 bytes in 3.045s)
The phone number can be seen under the
address
column and the corresponding text mes-
sage can be seen under the
body
column, as shown in the following screenshot:
Calls table in the contacts2.db file
Extracting browser history
Browser history information is one task that is often required to be reconstructed by a
forensic examiner. Apart from the default Android Browser, there are different browser
applications that can be used on an Android phone, such as Firefox Mobile, Google
Chrome, and so on. All of these browsers store their browser history in the SQLite
.db
format. For our example, we are extracting data from the default Android browser to our
forensic workstation. This data is located at
/data/data/com.android.browser
.
The file named
browser2.db
contains the browser history details. The following
screenshot shows the browser data as represented by Oxygen Forensic SQLite Database
Viewer. Note that the trial version will hide certain information.
