Investigating Android Gboard
25/10/2024 Friday
Gboard is the official Google keyboard App, developed as a virtual or 'on-screen' keyboard that allows users to type by tapping on their smartphone's touch screen. Like many other virtual keyboard apps, Gboard goes beyond basic text input, enabling users to send GIFs, emojis, and stickers. With its built-in voice-to-text feature, users can dictate messages hands-free. Additionally, Gboard supports multiple languages, allowing users to download and switch between language keyboards easily.
Digital Forensics Value of Android Gboard
Android Google Keyboard application retains important information in its artifacts, which can be invaluable in digital forensic investigations. Extracted data can assist forensic investigators in reconstructing past events. The session artifacts, for instance, provide insights into which applications were used and at what times on an Android device which can help in reconstructing timelines. Additionally, recovered clipboard items may reveal sensitive information like addresses, passwords, or fragments of communication that was copied and intended to be pasted elsewhere. These stored items will be there even if the original source is deleted.
Location of Android Gboard Artifacts
Android Gboard artifacts can be found at the following locations:
*/com.google.android.inputmethod*/databases/trainingcache*.db
*/com.google.android.inputmethod*/databases/gboard_clipboard.db
Analyzing Android Gboard Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Gboard artifact from Android devices and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Gboard artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Gboard artifact in ArtiFast.
Android Google Keyboard Sessions
- Session ID: The session unique identifier.
- Start Date/Time: The date/time when this session has been started.
- End Date/Time: The date/time when this session has been finished.
- Application Name: The application name which uses Google Keyboard during this session.
Android Google Keyboard Clipboard
- Copied Date/Time: The date and time when this item has been copied to the clipboard.
- ID: The unique identifier for this clipboard item.
- Type: The type of this clipboard item.
- Content: The content of this clipboard item.
- Content As HTML: The content of the clipboard item in HTML format.
- Is Pinned: Indicates if this clipboard content is pinned or not.
- URI: The clipboard content path on the local phone.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
