The Duck Hunters Guide - DuckDuckGo Android Forensics Cheat Sheet

By -

This cheat sheet contains the locations of forensic artifacts associated with the DuckDuckGo Android Browser. 

It will be periodically updated as research is conducted

History.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Browsing History

App.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Open Tabs
  • Bookmarks/Favorites
  • Fireproof Sites

Downloads.db

Location: data\data\com.duckduckgo.mobile.android\databases\

Artifacts: 

  • Download History
Cookies

Location: data\data\com.duckduckgo.mobile.android\app_webview\default

Artifacts: 

  • Cookies

com.duckduckgo.app.settings_activity.settings.xml

Location: data\data\com.duckduckgo.mobile.android\shared_prefs\

Artifacts: 

  • Automatic Clearing Settings

com.duckduckgo.app.fire.unsentpixels.settings.xml

Location: data\data\com.duckduckgo.mobile.android\shared_prefs\

Artifacts: 

  • Datetime when data was last cleared

tabPreviews Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Open Tab Preview Files
  • Closed Tab Preview Files

faviconsTemp Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Open Tab Favicons
  • Closed Tab Favicons

favicons Cache Folder

Location: data\data\com.duckduckgo.mobile.android\cache\

Artifacts: 

  • Bookmark Favicons
WebView Local Storage LevelDB

Location: data\data\com.duckduckgo.mobile.android\app_webview\Default\Local Storage\leveldb\

Artifacts: 

  • Duck AI Chat

Comments

Post a Comment

Popular posts from this blog

The Duck Hunters Guide - Blog #6 - DuckDuckGo Fireproof Sites (Android)

By -
Image
In this post I want to talk about fireproof sites in the Android version of the DuckDuckGo web browser and what information is immune to the fire button when a site is fireproofed. The concept of Fireproofing a site is a little misleading and when I searched online there is not much chatter about what this feature in the browser actually does. One would think that fireproofing a site would make browsing relating artifacts immune to the fire button, but this is not true. As part of my research process, I fireproofed a site  and then examined what data remained after clearing browsing data using the Fire Button. What I found is that the Fireproof feature preserves cookies for the selected site so users  don’t need to log in again after clearing data (session cookies remain intact). However, browsing history, cache, and other site data are still cleared , even for fireproofed sites. We will start with determining what sites the user has fireproofed. This information can be foun...
Read more

The Duck Hunters Guide - Blog #3 - DuckDuckGo Open Tab Information (Android)

By -
Image
In my last blog post I talked about DuckDuckGo browsing history on Android, and along that same theme, in this post I am going to breakdown the information that is stored for opened tabs. I initially planned to do open tabs and closed tabs in the same post, but it was getting really long so I will do another post for that in the coming days. The DuckDuckGo app will store various pieces of information about a user's tabs to populate certain areas of the app and restore a browsing session if the application is closed and reopened. Note: The Fire button will clear this information!  Thus far I have found the following Tab Information: URLs for open tabs Which is the currently active tab Screenshot of current webpage in open tabs Favicons for current webpage in open tabs This information is split between the app.db and the browser cache, and we can tie it all together. app.db Location:  data\data\com.duckduckgo.mobile.android\databases\ I will start out by talking about open tab i...
Read more

Inside Proton’s Vault: Uncovering Android Proton Drive Artifacts

By -
Image
Proton Drive is Proton’s answer to secure, privacy-first cloud storage, and its Android app  extends that same protection to mobile users. Proton is well known for its encrypted ecosystem: Proton Mail delivers end-to-end encrypted email, while Proton VPN provides anonymous, protected internet access. Proton Drive fits seamlessly into this suite of privacy-focused services, enabling users to upload, sync, and share files with all data being encrypted both in transit and at rest, ensuring that sensitive information remains under the user’s control. When approaching Proton Drive from a forensic perspective, just like other cloud storage apps, the first questions are often the simplest: what is the user account information, and what data is actually being stored?  so these questions are what I am going to focus on. Of course, with Proton’s well-advertised model of end-to-end encryption and data at rest encryption , it causes some challenges that are not as common with more mainst...
Read more