Digital Forensics with Damien

In this post I want to talk about downloaded files in the Android version of the DuckDuckGo web browser. Like all modern browsers, the DuckDuckGo web browser allows users to download files.  All downloaded files are stored in the Android standard location: /storage/emulated/0/Download/ The information about files downloaded is stored in the downloads.db SQLite database. downloads.db location:  data\data\com.duckduckgo.mobile.android\databases\ This database is very simple, with only the downloads table containing user data: Id - Unique ID for each tab downloadId - A 64-bit signed integer that is a unique identifier assigned to each download request. downloadStatus - The status of the download. That I have been able to figure out so far 0 = Started 1 = Completed filename - Name of the file downloaded contentLength - The size of the file in bytes filepath - The download location createdAt - The datetime when the download process was initiated. This is a text timestamp stored as ...