The Duck Hunters Guide - DuckDuckGo Android Forensics Cheat Sheet

By -

This cheat sheet contains the locations of forensic artifacts associated with the DuckDuckGo Android Browser. 

It will be periodically updated as research is conducted

History.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Browsing History

App.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Open Tabs
  • Bookmarks/Favorites
  • Fireproof Sites

Downloads.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Download History
Cookies

Location: data\data\com.duckduckgo.mobile.android\app_webview\default

Artifacts: 

  • Cookies

com.duckduckgo.app.settings_activity.settings.xml

Location: data\data\com.duckduckgo.mobile.android\shared_prefs\

Artifacts: 

  • Automatic Clearing Settings

com.duckduckgo.app.fire.unsentpixels.settings.xml

Location: data\data\com.duckduckgo.mobile.android\shared_prefs\

Artifacts: 

  • Datetime when data was last cleared

tabPreviews Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Open Tab Preview Files
  • Closed Tab Preview Files

faviconsTemp Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Open Tab Favicons
  • Closed Tab Favicons

favicons Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Bookmark Favicons
WebView Local Storage LevelDB

Location: data\data\com.duckduckgo.mobile.android\app_webview\Default\Local Storage\leveldb\

Artifacts: 

  • Duck AI Chat

Comments

Post a Comment

Popular posts from this blog

Inside Proton’s Vault: Uncovering Android Proton Drive Artifacts

By -
Image
Proton Drive is Proton’s answer to secure, privacy-first cloud storage, and its Android app  extends that same protection to mobile users. Proton is well known for its encrypted ecosystem: Proton Mail delivers end-to-end encrypted email, while Proton VPN provides anonymous, protected internet access. Proton Drive fits seamlessly into this suite of privacy-focused services, enabling users to upload, sync, and share files with all data being encrypted both in transit and at rest, ensuring that sensitive information remains under the user’s control. When approaching Proton Drive from a forensic perspective, just like other cloud storage apps, the first questions are often the simplest: what is the user account information, and what data is actually being stored?  so these questions are what I am going to focus on. Of course, with Proton’s well-advertised model of end-to-end encryption and data at rest encryption , it causes some challenges that are not as common with more mainst...
Read more

The Realm Files - Vol 2 - Physical Structure Overview

By -
Image
In this second installment of the Realm Files, we will move into the physical structure of a Realm Database and discuss how it is conceptually laid on disk. At the physical level, a Realm database is organized as a hierarchy of arrays arranged in a B-tree-like structure. At the top of this hierarchy is the Group , the top-level node that serves as the root of the database. The Group contains references to Tables , each representing a class within the Realm schema. Each Table maintains a Cluster Tree which is  Realm’s implementation of a B+ tree that organizes object data into Clusters at the leaf level. These Clusters store the actual object data for the database records, making them the end points of the structure and the primary source of evidentiary content.  The challenge, forensically speaking, is linking the Clusters back to their corresponding Tables (Classes) and Columns (Properties) within those tables. To accomplish this, we must traverse the hierarchy beginning a...
Read more

The Realm Files - Vol 1 - Intro to RealmDB

By -
Image
In this new blog series, "The Realm Files", I’ll be digging into the physical structure of RealmDB. The goal is to give examiners a deeper understanding of how Realm actually works, so they can validate what their tools parse if supported and have a clear methodology to extract the data when the tool does not support it. Unlike other database formats such as SQLite or LevelDB, the file structure of RealmDB is not well documented in the public domain. While a few academic papers touch on specific applications that utilize Realm databases, and one mobile forensics book includes a chapter on the subject, there are still significant gaps. What is missing is detailed guidance on how to interpret the payload of an array and rebuild the database. This process is not as straightforward as it might first appear. Below is the link to the Realm Forensics Chapter in the Mobile Forensics - The File Format Handbook which has a great introduction to RealmDB  Realm Forensics Chapter:  Mobile...
Read more