Browser forensic tool
Author: h | 2025-04-25
Popular computer forensics top 19 tools [updated 2025] 7 best computer forensics tools [updated 2025] Spoofing and Anonymization (Hiding Network Activity) Browser Forensics: Safari; Browser Forensics: IE 11; Browser Forensics: Firefox; Browser forensics: Google chrome; Webinar summary: Digital forensics and incident response Is it the Popular computer forensics top 19 tools [updated 2025] 7 best computer forensics tools [updated 2025] Spoofing and Anonymization (Hiding Network Activity) Browser Forensics: Safari; Browser Forensics: IE 11; Browser Forensics: Firefox; Browser forensics: Google chrome; Webinar summary: Digital forensics and incident response Is it the
Digital Forensics Tool: Browser Forensics - YouTube
Browser History Examiner 1.1DownloadA forensic software tool for extracting and analysing internet historyYour vote:Latest version:1.20.1See allDeveloper:Foxton SoftwareReviewDownloadComments Questions & Answers 1 / 1Used by 1 personAll versionsBrowser History Examiner 1.20.1 (latest)Browser History Examiner 1.4 DownloadEdit program infoInfo updated on:Mar 15, 2025Software InformerDownload popular programs, drivers and latest updates easilyNo specific info about version 1.1. Please visit the main page of Browser History Examiner on Software Informer.Share your experience:Write a review about this program Comments Your vote:Notify me about replies Comment viaFacebookRelated software Browser History Cleaner FreeBrowser History Cleaner removes private data from many Internet browsers.iPhone Backup Browser FreeYou can use iPhone Backup Browser to extract contacts, calendar events, etc.Browser Forensic Tool FreeIt is an advanced local browser history search engine.Magic Browser Recovery Recover and analyze information from web browsers.Google Toolbar History Mate This program will help you to track the "Search History List" of Google Toolbar.Related storiesSee allСhange Edge as the default browser in Windows 10Google's Chrome browser to get a major overhaul next monthMozilla launches its own VR browser: Firefox RealityMicrosoft Edge has become the second most popular browserTagsInternet historyExtract historyAnalyze historyInteractive graphForensic softwareBest browser extensionsUnity Web PlayerMoney Robot SubmitterInternet History EraserHistoryKillBrowser Forensic ToolBrowserStar Free Download MOBILedit Forensic Express Pro 7.4.1.21502 Full Version for Windows - World’s most trusted phone investigation tool.Free Download MOBILedit Forensic 10 / MOBILedit Forensic Express Pro 7 for Windows is the world’s most trusted phone investigation tool. Highly rated by the National Institute of Standards and Technology, MOBILedit! Forensic is the primary mobile device investigation tool used in over 70 countries. Connect a phone and MOBILedit! Forensic extracts all content and generates a forensic report ready for courtroom presentation. You can also FREE download WhatSender Pro: Software to send BULK WhatsApp messages from PCOverview of MOBILedit Forensic Pro 7 / 10 BenefitsThese tamper-proof, flawless reports are used in hundreds of courtrooms every day. Mobile phones contain some of the most important evidence in criminal investigations. Law enforcement agencies around the world need every possible advantage to help solve crimes. MOBILedit! Forensics has changed the way this evidence is obtained and presented. It provides reports with tamper-proof and indisputable evidence in a court of law. This report details out every piece of information on the phone, such as call history, list of contacts, messages, photos, voice recordings, video, files, calendar, tasks, notes, etc. Overview of MOBILedit Forensic Pro 7 / 10 FeaturesAnalyze phones via Bluetooth, IrDA or cable connection Large quantity of phones supported Frequent updates and upgrades with new features and more phones Direct SIM analyzer through SIM readers Reads deleted messages from the SIM card Reports Generator based on your templates Print reports ready for courtroom Reports generated in any language Make backup now and reports when needed Manual investigation mode Secure and tamper-proof using MD5 hash Compliant with Word or any other RTF editor View formatted reports in browser including original pictures Exports to Word, Excel/XLS, browser, XML/XSL Complete solution including specific phone cables and SIM readers XML export – seamlessly connect MOBILedit! Forensic data with other systems Preferred/forbidden networks Hex dump viewerTechnical Details and System RequirementsSupported OS: Windows 10, Windows 8.1, Windows 7RAM (Memory): 2 GB RAM (4 GB recommended)Free Hard Disk Space: 2 GB or morePrevious versionFile Name:MOBILedit Forensic Express Pro 7.4.1.21057Version:7.4.1.21057File Name:MOBILedit Forensic Express Pro 7.4.0.20408Version:7.4.0.20408File Name:MOBILedit Forensic Express Pro 7.4.0.20393Version:7.4.0.20393File Name:MOBILedit Forensic Express Pro 7.3.1.19994Version:7.3.1.19994File Name:MOBILedit Forensic Express Pro 7.3.1.19815Version:7.3.1.19815File Name:MOBILedit Forensic Express Pro 7.3.1.19798Version:7.3.1.19798File Name:MOBILedit Forensic Express Pro 7.3.0.19270Version:7.3.0.19270File Name:MOBILedit Forensic Express Pro 7/10 (x86-x64)Version:7.2.0.17975CommentsAnalysis Web Browser Forensic Using Browser Forensic Tools
The device, make sure the automatic syncing option is enabled on iTunes.This method is a very simple way to copy data using the browser. One can use logical acquisition method using the iDevice browser as an alternate, and it depends on the scenario. Another tool that can perform logical acquisition is described below.Logical acquisitionLogical acquisition can be performed with the help of various commercial tools such as Oxygen Forensic Suite, UFED physical analyzer, Cellebrite, Blacklight, XRY. We would be demonstrating Logical Acquisition with the help of Oxygen forensic suite and UFED physical analyzer tools below.Logical Acquisition using Oxygen Forensic SuiteUsing Oxygen Forensic Suite which is a commercial tool, we could perform logical acquisition of iPhone. Steps as described as below Launch the Oxygen Forensic Suite. Select the Connect device option to start extraction. It would prompt to select automatically connect a device or manually connect the device. It is recommended to use the First option which is automatically connecting the phone. Oxygen forensic suite would start searching for the phone once selected automatically connects option. The software will provide UUID of the detected phone and if the phone is password protected and locked it would ask to provide a password or lock down certificate.As shown in below figure, if the password is known then examiner needs to enter and authorize password on the device and select the option "I entered the passcode. Press to connect" or select lockdown plist.Figure 14. Enter a passcode or choose lockdown certificate After the successful. Popular computer forensics top 19 tools [updated 2025] 7 best computer forensics tools [updated 2025] Spoofing and Anonymization (Hiding Network Activity) Browser Forensics: Safari; Browser Forensics: IE 11; Browser Forensics: Firefox; Browser forensics: Google chrome; Webinar summary: Digital forensics and incident response Is it theWeb Browser Forensic Tool.docx - Web Browser Forensic Tool.
Browser Forensic Tool v2.0 - Advanced browser history search engineBrowser Forensic Tool v2.0 , Developed by DarkCoderSc (Jean-Pierre LESUEUR) ,is an advanced local browser history search engine, in less than few seconds it will extract the chosen keywords of most famous web browser, actually Internet Explorer, Google Chrome, Mozilla FireFox, RockMelt, Comodo Dragon and Opera.BFT will attempt to find the keyword(s) in the history title and search, if the keyword is present or suspected to be, it will be display in the result list with his URL and Title. The software also give you the possibility to edit the default keywords and of course add / modify your own keywords, to separate keywords subject you can create your own keywords categories and only scan for some keywords in the chosen category .The program is fully asynchronous so it won't affect your work during the scan time nor it will block the customization of keywords and keylist and can be canceled at anytime.Download Here The first section is the Common section which includes information related to the native applications. The second section includes activities related to the applications installed on IOS device.Information like calendar events, phonebook with assigned photos, call logs, messages and voice mail could be extracted by analysis of preinstalled applications. The figure below shows call history.Figure 39. Main Analysis Window Oxygen forensic suiteFigure 40. Call history logsInformation related to Wi-Fi access points, IP connections and locations can also be gathered using Oxygen forensic tool. For each network SSID, MAC address of the router, the timestamp of connection is presented by the tool as shown in the figure below.Figure 41. Wi-Fi DataThe tool extracts the database, as well as plist files from the application, installed on the device. These applications are categorized into the following types. Messengers: Facebook, Skype, WhatsApp and more Navigations: Google Maps, Waze, Apple Maps and more Browser: Safari, Google Chrome and so on Social networks: Facebook, Twitter, Instagram and more Travel: Booking, Sky Scanner and moreThere is advanced functionality offered by Oxygen forensic tool as listed below Aggregated Contacts: Contacts from multiple sources like Phonebook, Skype, Messages, Facebook, and more are analyzed in Aggregated Contacts. It automatically identifies common contact from multiple sources and groups them in Meta contact. Dictionaries: Words entered in messages, notes, and calendars are shown in this section Links and Stats: This section provides a tool to determine the social connection between users of mobile devices by analyzing calls, texts, multimedia, and email messages.Browser Forensic Tools - Archive.org
Device running Android operating system, he can mount a received image on FTK Imager [7, 8] or UFS Explorer [9]. Memory dumps of mobile devices running Android operating system usually contain a great number of logical partitions (ref. Figure 1). Mobile device user’s data are in the logical partition, which is named «USERDATA». From this partition, you can extract such data as databases (usually, such databases have SQLite format), videos, graphic files, audio files, etc.Figure 1. View of logical partitions of Samsung GT-I9300 in the window «Evidence Tree» of the FTK Imager program.In case, forensic expert examines the file that is a copy of a logical partition, which has YAFFS2 file system, he can gain access to logical data of this file via Encase Forensic version 7 [10].2.2. Decoding of SQLite databaseAs a rule, SQLite databases extracted from mobile device memory dump are of the utmost interest to forensic expert. First, it is connected with the fact that valuable criminalistics information is stored in this format. In SQLite databases the following data are stored: a phone book, calls, SMS messages, MMS messages, dictionaries, data of mobile device web-browsers, mobile device system’s logs and etc. The list of the most valuable SQLite databases, from criminalistics point of view, is given in the Table 1.Mobile devices SQLite databases№Type of dataName of file1Phone book\data\data\com.android.providers.contacts\ databases\contacts2.db2SMS, MMS messages\data\data\com.android.providers.telephony\ databases\mmssms.db3Calendar\data\com.android.providers.calendar\databases\ calendar.db4Log\data\com.sec.android.provider.logsprovider\ databases\logs.db5User’s data\data\system\users\accounts.db6Web-browser history\data\data\com.android.browser\databases\ browser2.db7Dictionary\data\user\comc.android.providers.userdictionary\ databases\user_dict.dbTable 1.For more detailed information about the names of databases that might be valuable for forensic expert and their location you can follow the link [11].Forensic expert should choose a tool very carefully – SQLite analysis program. It is connected with the fact that many viewer-programs can not decode some timestamps formats and recover deleted data that are in this kind of databases.Some researchers [8] propose to use two programs to decode files from SQLite databases: DCode v4.02a, SQLite Database Browser 2.0b1. In case we use combination of these programs, there is still a problem of recovering and analyzing of deleted files.One of the tools that solve this problem is Oxygen Forensic® SQLite Viewer [3]. This utility program is oriented on decoding SQLite bases also it can recover data.3. Recovering of deleted data and filesRecovering of mobile devices’ deleted data and files is a complicated process. It is connected with hardware organization of data storage in the mobile devices memory chips and also with specific features of the file systems.Browser forensics. Browser forensics plays
Facebook Password Dump : Free Command-line Tool to Recover Lost or Forgotten Facebook Password Facebook Password Dump Note: This software is no longer supported. Please Download our PRO version below for command-line feature and more benefits. See Also Free Windows Password Recovery Tools Our New Enterprise Edition of Facebook Password Recovery Pro Facebook Password Decryptor: GUI based Facebook Password Recovery Tool Facebook History Spy : All-in-one Facebook Web History Viewer Universal Ad Blocker: All-in-one Tool to Block Ads across All Web Browsers Contents About How to use? Screenshots Release History Download About Facebook Password Dump is the command-line tool to instantly recover your lost Facebook password from popular web browsers and messengers. Currently it can recover your Facebook password from following applications, Firefox Google Chrome Microsoft Edge Internet Explorer UC Browser Torch Browser Chrome Canary/SXS CoolNovo Browser Opera Browser Apple Safari Brave Browser Flock Browser SeaMonkey Browser Comodo Dragon Browser SRWare Iron Browser Paltalk Messenger Miranda Messenger It automatically discovers installed applications on your system and recovers all the stored Facebook login passwords within seconds. Being command-line tool makes it ideal tool for penetration testers and forensic investigators. For more enhanced features, check out our new Facebook Password Recovery Pro Enterprise Edition Note: Facebook Password Dump is not hacking or cracking tool as it can only help you to recover your own lost Facebook password that is previously stored in web browsers/messengers. Facebook Password Dump works on both 32-bit & 64-bit platforms starting from Windows XP to new Windows 10 version. How to use? Facebook Password Dump is very easy to use tool. It is command-line/console based tool, hence you have to launch it from the command prompt (cmd.exe). Here is the simple usage information, FacebookPasswordDump.exe [-h | -f ] Examples of Facebook Password Dump //Dump all the facebook passwords. Popular computer forensics top 19 tools [updated 2025] 7 best computer forensics tools [updated 2025] Spoofing and Anonymization (Hiding Network Activity) Browser Forensics: Safari; Browser Forensics: IE 11; Browser Forensics: Firefox; Browser forensics: Google chrome; Webinar summary: Digital forensics and incident response Is it the Popular computer forensics top 19 tools [updated 2025] 7 best computer forensics tools [updated 2025] Spoofing and Anonymization (Hiding Network Activity) Browser Forensics: Safari; Browser Forensics: IE 11; Browser Forensics: Firefox; Browser forensics: Google chrome; Webinar summary: Digital forensics and incident response Is it theEvaluation of Firefox Browser Forensics Tools
All Features and Benefits Passwordless AuthenticationThe password and two-factor authentication are the biggest challenges in cloud extraction. Elcomsoft Cloud Explorer offers passwordless authentication based on using binary authentication tokens extracted from the user's computer. Passwordless authentication enables access to the following data categories: Chrome (including browsing history, bookmarks and passwords), Calendars, Dashboards, History, Google Drive, and Hangouts.Passwordless authentication into Google Account is available if Google Chrome is installed on the user’s computer, and the user signed in to at least one Google service via the browser. The new Google Token Extractor (GTEX) tool automatically searches the user’s computer for authentication tokens saved by the Google Chrome browser. Once the user signs in to their Google Account in a browser session, these tokens enable seamless access to Google services without the need to re-enter the password. Two-Factor Authentication SupportIn order to access someone’s data, investigators must supply the correct Google ID and password. Since many users protect access to their accounts with two-step authentication, access to the secondary authentication factor is required if two-step authentication is enabled.Elcomsoft Cloud Explorer supports most two-factor authentication methods implemented by Google, including 6-digit codes generated by the Authenticator app or delivered as text messages to a trusted phone number; printable backup codes, Google Prompt and FIDO Key authentication. Viewing, Searching and Analyzing the DataElcomsoft Cloud Explorer is not just about downloading information. It’s an all-in-one forensic tool allowing to view and analyze information obtained from the user’s Google Account.The built-in viewer supports the most popular data formats used in the Google Account, parsing and displaying them automatically. The viewer includes instant filtering and quick search functionality. Finding a certain contact, message or Web site authentication credentials is easy: you just need to type part of the word you are looking for into the search box. Forensic Gmail AcquisitionElcomsoft Cloud Explorer offers fast offline access to Gmail communication history. The tool can download all or some email messages from the user’s Gmail account, allowing investigators specifying the exact period to acquire. Access to messages is implemented via Google’s proprietary Gmail API, which makes it possible toComments
Browser History Examiner 1.1DownloadA forensic software tool for extracting and analysing internet historyYour vote:Latest version:1.20.1See allDeveloper:Foxton SoftwareReviewDownloadComments Questions & Answers 1 / 1Used by 1 personAll versionsBrowser History Examiner 1.20.1 (latest)Browser History Examiner 1.4 DownloadEdit program infoInfo updated on:Mar 15, 2025Software InformerDownload popular programs, drivers and latest updates easilyNo specific info about version 1.1. Please visit the main page of Browser History Examiner on Software Informer.Share your experience:Write a review about this program Comments Your vote:Notify me about replies Comment viaFacebookRelated software Browser History Cleaner FreeBrowser History Cleaner removes private data from many Internet browsers.iPhone Backup Browser FreeYou can use iPhone Backup Browser to extract contacts, calendar events, etc.Browser Forensic Tool FreeIt is an advanced local browser history search engine.Magic Browser Recovery Recover and analyze information from web browsers.Google Toolbar History Mate This program will help you to track the "Search History List" of Google Toolbar.Related storiesSee allСhange Edge as the default browser in Windows 10Google's Chrome browser to get a major overhaul next monthMozilla launches its own VR browser: Firefox RealityMicrosoft Edge has become the second most popular browserTagsInternet historyExtract historyAnalyze historyInteractive graphForensic softwareBest browser extensionsUnity Web PlayerMoney Robot SubmitterInternet History EraserHistoryKillBrowser Forensic ToolBrowserStar
2025-04-18Free Download MOBILedit Forensic Express Pro 7.4.1.21502 Full Version for Windows - World’s most trusted phone investigation tool.Free Download MOBILedit Forensic 10 / MOBILedit Forensic Express Pro 7 for Windows is the world’s most trusted phone investigation tool. Highly rated by the National Institute of Standards and Technology, MOBILedit! Forensic is the primary mobile device investigation tool used in over 70 countries. Connect a phone and MOBILedit! Forensic extracts all content and generates a forensic report ready for courtroom presentation. You can also FREE download WhatSender Pro: Software to send BULK WhatsApp messages from PCOverview of MOBILedit Forensic Pro 7 / 10 BenefitsThese tamper-proof, flawless reports are used in hundreds of courtrooms every day. Mobile phones contain some of the most important evidence in criminal investigations. Law enforcement agencies around the world need every possible advantage to help solve crimes. MOBILedit! Forensics has changed the way this evidence is obtained and presented. It provides reports with tamper-proof and indisputable evidence in a court of law. This report details out every piece of information on the phone, such as call history, list of contacts, messages, photos, voice recordings, video, files, calendar, tasks, notes, etc. Overview of MOBILedit Forensic Pro 7 / 10 FeaturesAnalyze phones via Bluetooth, IrDA or cable connection Large quantity of phones supported Frequent updates and upgrades with new features and more phones Direct SIM analyzer through SIM readers Reads deleted messages from the SIM card Reports Generator based on your templates Print reports ready for courtroom Reports generated in any language Make backup now and reports when needed Manual investigation mode Secure and tamper-proof using MD5 hash Compliant with Word or any other RTF editor View formatted reports in browser including original pictures Exports to Word, Excel/XLS, browser, XML/XSL Complete solution including specific phone cables and SIM readers XML export – seamlessly connect MOBILedit! Forensic data with other systems Preferred/forbidden networks Hex dump viewerTechnical Details and System RequirementsSupported OS: Windows 10, Windows 8.1, Windows 7RAM (Memory): 2 GB RAM (4 GB recommended)Free Hard Disk Space: 2 GB or morePrevious versionFile Name:MOBILedit Forensic Express Pro 7.4.1.21057Version:7.4.1.21057File Name:MOBILedit Forensic Express Pro 7.4.0.20408Version:7.4.0.20408File Name:MOBILedit Forensic Express Pro 7.4.0.20393Version:7.4.0.20393File Name:MOBILedit Forensic Express Pro 7.3.1.19994Version:7.3.1.19994File Name:MOBILedit Forensic Express Pro 7.3.1.19815Version:7.3.1.19815File Name:MOBILedit Forensic Express Pro 7.3.1.19798Version:7.3.1.19798File Name:MOBILedit Forensic Express Pro 7.3.0.19270Version:7.3.0.19270File Name:MOBILedit Forensic Express Pro 7/10 (x86-x64)Version:7.2.0.17975Comments
2025-04-08The device, make sure the automatic syncing option is enabled on iTunes.This method is a very simple way to copy data using the browser. One can use logical acquisition method using the iDevice browser as an alternate, and it depends on the scenario. Another tool that can perform logical acquisition is described below.Logical acquisitionLogical acquisition can be performed with the help of various commercial tools such as Oxygen Forensic Suite, UFED physical analyzer, Cellebrite, Blacklight, XRY. We would be demonstrating Logical Acquisition with the help of Oxygen forensic suite and UFED physical analyzer tools below.Logical Acquisition using Oxygen Forensic SuiteUsing Oxygen Forensic Suite which is a commercial tool, we could perform logical acquisition of iPhone. Steps as described as below Launch the Oxygen Forensic Suite. Select the Connect device option to start extraction. It would prompt to select automatically connect a device or manually connect the device. It is recommended to use the First option which is automatically connecting the phone. Oxygen forensic suite would start searching for the phone once selected automatically connects option. The software will provide UUID of the detected phone and if the phone is password protected and locked it would ask to provide a password or lock down certificate.As shown in below figure, if the password is known then examiner needs to enter and authorize password on the device and select the option "I entered the passcode. Press to connect" or select lockdown plist.Figure 14. Enter a passcode or choose lockdown certificate After the successful
2025-03-28Browser Forensic Tool v2.0 - Advanced browser history search engineBrowser Forensic Tool v2.0 , Developed by DarkCoderSc (Jean-Pierre LESUEUR) ,is an advanced local browser history search engine, in less than few seconds it will extract the chosen keywords of most famous web browser, actually Internet Explorer, Google Chrome, Mozilla FireFox, RockMelt, Comodo Dragon and Opera.BFT will attempt to find the keyword(s) in the history title and search, if the keyword is present or suspected to be, it will be display in the result list with his URL and Title. The software also give you the possibility to edit the default keywords and of course add / modify your own keywords, to separate keywords subject you can create your own keywords categories and only scan for some keywords in the chosen category .The program is fully asynchronous so it won't affect your work during the scan time nor it will block the customization of keywords and keylist and can be canceled at anytime.Download Here
2025-04-15The first section is the Common section which includes information related to the native applications. The second section includes activities related to the applications installed on IOS device.Information like calendar events, phonebook with assigned photos, call logs, messages and voice mail could be extracted by analysis of preinstalled applications. The figure below shows call history.Figure 39. Main Analysis Window Oxygen forensic suiteFigure 40. Call history logsInformation related to Wi-Fi access points, IP connections and locations can also be gathered using Oxygen forensic tool. For each network SSID, MAC address of the router, the timestamp of connection is presented by the tool as shown in the figure below.Figure 41. Wi-Fi DataThe tool extracts the database, as well as plist files from the application, installed on the device. These applications are categorized into the following types. Messengers: Facebook, Skype, WhatsApp and more Navigations: Google Maps, Waze, Apple Maps and more Browser: Safari, Google Chrome and so on Social networks: Facebook, Twitter, Instagram and more Travel: Booking, Sky Scanner and moreThere is advanced functionality offered by Oxygen forensic tool as listed below Aggregated Contacts: Contacts from multiple sources like Phonebook, Skype, Messages, Facebook, and more are analyzed in Aggregated Contacts. It automatically identifies common contact from multiple sources and groups them in Meta contact. Dictionaries: Words entered in messages, notes, and calendars are shown in this section Links and Stats: This section provides a tool to determine the social connection between users of mobile devices by analyzing calls, texts, multimedia, and email messages.
2025-03-29Device running Android operating system, he can mount a received image on FTK Imager [7, 8] or UFS Explorer [9]. Memory dumps of mobile devices running Android operating system usually contain a great number of logical partitions (ref. Figure 1). Mobile device user’s data are in the logical partition, which is named «USERDATA». From this partition, you can extract such data as databases (usually, such databases have SQLite format), videos, graphic files, audio files, etc.Figure 1. View of logical partitions of Samsung GT-I9300 in the window «Evidence Tree» of the FTK Imager program.In case, forensic expert examines the file that is a copy of a logical partition, which has YAFFS2 file system, he can gain access to logical data of this file via Encase Forensic version 7 [10].2.2. Decoding of SQLite databaseAs a rule, SQLite databases extracted from mobile device memory dump are of the utmost interest to forensic expert. First, it is connected with the fact that valuable criminalistics information is stored in this format. In SQLite databases the following data are stored: a phone book, calls, SMS messages, MMS messages, dictionaries, data of mobile device web-browsers, mobile device system’s logs and etc. The list of the most valuable SQLite databases, from criminalistics point of view, is given in the Table 1.Mobile devices SQLite databases№Type of dataName of file1Phone book\data\data\com.android.providers.contacts\ databases\contacts2.db2SMS, MMS messages\data\data\com.android.providers.telephony\ databases\mmssms.db3Calendar\data\com.android.providers.calendar\databases\ calendar.db4Log\data\com.sec.android.provider.logsprovider\ databases\logs.db5User’s data\data\system\users\accounts.db6Web-browser history\data\data\com.android.browser\databases\ browser2.db7Dictionary\data\user\comc.android.providers.userdictionary\ databases\user_dict.dbTable 1.For more detailed information about the names of databases that might be valuable for forensic expert and their location you can follow the link [11].Forensic expert should choose a tool very carefully – SQLite analysis program. It is connected with the fact that many viewer-programs can not decode some timestamps formats and recover deleted data that are in this kind of databases.Some researchers [8] propose to use two programs to decode files from SQLite databases: DCode v4.02a, SQLite Database Browser 2.0b1. In case we use combination of these programs, there is still a problem of recovering and analyzing of deleted files.One of the tools that solve this problem is Oxygen Forensic® SQLite Viewer [3]. This utility program is oriented on decoding SQLite bases also it can recover data.3. Recovering of deleted data and filesRecovering of mobile devices’ deleted data and files is a complicated process. It is connected with hardware organization of data storage in the mobile devices memory chips and also with specific features of the file systems.
2025-04-06