Digital Forensics with Damien

In my last Duck Hunters Guide post I discussed forensic artifacts associated with Tabs that are open in the Android DuckDuckGo Browser, now I will move onto residual artifacts that are left behind when the user closes a tab or clears their tab data. I will be talking about the same artifacts as previously so if you haven't read my previous post here it is:  The Duck Hunters Guide - Blog #3 - DuckDuckGo Open Tab Information (Android)  Tab information! As I have determined already, browser Tab information goes into the Tabs and Tab_selection tables in the app.db SQLite database. When a user closes a tab, the associated information is deleted from the table. If I query the Tabs table, I currently have 3 open tabs. app.db location: data\data\com.duckduckgo.mobile.android\databases\ Query location:   Android - DuckDuckGo Open Tabs.sql As this is an SQLite database, there are options for us to potentially recover closed tab information. The app.db utilizes a Rollback Journal i...