DFIR Tips GR Rajesh Kumar

ANDROID
DOWNLOADS
MOBILE FORENSICS
DFIR Tips GR Rajesh Kumar

Digital Forensics Value

of Android Downloads
When Android users download or receive files
through email or messaging apps, they are
typically stored in the Downloads folder by
default. This folder contains various file types,
such as documents, images, videos, audio files,
and APK packages. For forensic experts,
analyzing the Downloads folder is essential for
reconstructing events, establishing timelines,
identifying behavioural patterns, and
uncovering crucial details related to digital
crimes and activities.
DFIR Tips GR Rajesh Kumar

Location
Android Downloads artifacts can be found
at the following location:

com.android.providers.downloads
/databases/downloads.db
DFIR Tips GR Rajesh Kumar

Forensic Analysis
Modified Date: Last modified date/time.
Download Source: The URL of the downloaded file.
MIME Type: The type of the data stored in this file.
Status: Indicates whether this file has been downloaded
successfully or not.
Saved To: The local path where this file has been saved to.
Deleted: Indicates whether this file has been deleted or
not.
Notification Package: Notification package.
Title: The name of the downloaded file.
Media Provider URI: The URI of the media provider App.
Error Message: The reason for the error happened while
downloading this file.
DFIR Tips GR Rajesh Kumar
CASE SCENARIO

Suspected Corporate
Data Theft
Background:
A technology company suspects that one of
its employees has been involved in corporate
data theft. The employee, who had access to
sensitive company documents and intellectual
property, recently resigned and joined a
competitor.

The company's IT team has secured the

employee's work-issued Android device for
investigation.
DFIR Tips GR Rajesh Kumar

Investigation Steps:
01.. Acquisition of the Device:
The company's IT department acquires the ex-
employee's Android device, ensuring it is
handled in a forensically sound manner to
preserve evidence.

02. Analysis of the Downloads Folder:

The digital forensics team focuses on the
device's Downloads folder as it often contains
recently acquired files. Using forensic tools, they
extract and analyze the contents of the folder.
DFIR Tips GR Rajesh Kumar

Investigation Steps:
03. Uncovering Evidence:

They discover several PDF files that appear to

be proprietary company documents related to
upcoming product development and business
strategies.

They also find images and videos related to

company projects and internal meetings.
APK files for file-sharing apps not approved by
the company are found in the Downloads folder.
DFIR Tips GR Rajesh Kumar

Investigation Steps:
04. Establishing a Timeline:

By examining file timestamps, they establish a

timeline of when these files were downloaded
or received.

They identified that most of the sensitive files

were transferred to the Downloads folder
shortly before the employee's resignation.
DFIR Tips GR Rajesh Kumar

Investigation Steps:
05. Patterns of Behavior:

The analysis reveals that the ex-employee had

been using personal email and messaging apps
to receive and store these sensitive files.

They note a consistent pattern of accessing the

Downloads folder after work hours.
DFIR Tips GR Rajesh Kumar

Investigation Steps:
06. Building a Case:

The evidence from the Downloads folder

becomes a critical component in building a case
against the ex-employee.

The company can now establish that the

individual had unauthorized possession of
confidential company data and transferred it to
their personal device, potentially for the benefit
of their new employer.
DFIR Tips GR Rajesh Kumar

Investigation Steps:
07. Legal Action:

With this evidence, the company can take legal

action against the ex-employee for data theft
and breach of their employment contract.
DFIR Tips GR Rajesh Kumar

GR Rajesh Kumar
Digital Forensic Investigator

Like, share & comment

If you have any other topics you'd like me to
post about, or just share your thoughts on
this post, please comment below.

Follow me for the latest updates in #DFIR.