The Duck Hunters Guide - DuckDuckGo Android Cheat Sheet

By -

This cheat sheet contains the locations of forensic artifacts associated with the DuckDuckGo Android Browser. 

It will be periodically updated as research is conducted

History.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Browsing History

App.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Open Tabs
  • Bookmarks/Favorites
  • Fireproof Sites

Cookies

Location: data\data\com.duckduckgo.mobile.android\app_webview\default

Artifacts: 

  • Cookies

com.duckduckgo.app.settings_activity.settings.xml

Location: data\data\com.duckduckgo.mobile.android\shared_prefs\

Artifacts: 

  • Automatic Clearing Settings

com.duckduckgo.app.fire.unsentpixels.settings.xml

Location: data\data\com.duckduckgo.mobile.android\shared_prefs\

Artifacts: 

  • Datetime when data was last cleared

tabPreviews Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Open Tab Preview Files
  • Closed Tab Preview Files

faviconsTemp Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Open Tab Favicons
  • Closed Tab Favicons

favicons Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Bookmark Favicons

Comments

Post a Comment

Popular posts from this blog

The Duck Hunters Guide - Blog #6 - DuckDuckGo Fireproof Sites (Android)

By -
Image
In this post I want to talk about fireproof sites in the Android version of the DuckDuckGo web browser and what information is immune to the fire button when a site is fireproofed. The concept of Fireproofing a site is a little misleading and when I searched online there is not much chatter about what this feature in the browser actually does. One would think that fireproofing a site would make browsing relating artifacts immune to the fire button, but this is not true. As part of my research process, I fireproofed a site  and then examined what data remained after clearing browsing data using the Fire Button. What I found is that the Fireproof feature preserves cookies for the selected site so users  don’t need to log in again after clearing data (session cookies remain intact). However, browsing history, cache, and other site data are still cleared , even for fireproofed sites. We will start with determining what sites the user has fireproofed. This information can be foun...
Read more

The Duck Hunters Guide - Blog #1 - DuckDuckGo Privacy Browser Research Project

By -
Image
One of my passions in Digital Forensics is ripping apart applications and trying to figure out how they work and how they store data. Over the past 5 years as part of my job, I have had what some may call an "unhealthy" obsession with Dark Web applications. I have looked into Tor, I2P, Hyphanet (Formerly Freenet) and ZeroNet on multiple platforms, examining the features as new updates come out, in an attempt to uncover usage artifacts.  So, for a new research project (in my personal time) and for my first blog series I will be following a similar methodology to track down user artifacts associated with the DuckDuckGo privacy browser. This project has been on my research list for some time, and what sparked my interest was a blog I read in early 2024 that compares the application decoding capabilities of forensics tools.  Link:   iOS 15 Image Forensics Analysis and Tools Comparison - Browsers, Mail Clients, and Productivity apps I wasn't entirely shocked about the differe...
Read more