Investigating Android GMX Mail
13/09/2024 Friday
GMX Mail is a free email service provided by GMX (Global Mail eXchange), a German company United Internet subsidiary. It offers users unlimited email storage, file sharing, and calendar management. The GMX became the first large to use pop-up ads and remains one of the top 10 mail providers based on multiple resources.
Digital Forensics Value of Android GMX Mail
Android GMX mail application holds considerable forensics value. It captures a variety of artifacts, such as emails, account details, attachments, and contact information, which can provide insights into user communication and behavior. Forensic analysis of GMX's app data can uncover timestamps, message content, attachments, and address book information, which are crucial for reconstructing communication patterns.
Location of Android GMX Mail Artifacts
Android GMX Mail artifacts can be found at the following location:
*/data/de.gmx.mobile.android.mail/databases/identitiy_db
*/data/de.gmx.mobile.android.mail/databases/mail_room.db
*/data/de.gmx.mobile.android.mail/databases/known_receivers
Analyzing Android GMX Mail Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android GMX Mail artifact from Android devices' files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android GMX Mail artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android GMX Mail artifact in ArtiFast.
Android GMX Webmail Accounts Information
- Time: The date and time the account last signed in.
- Name: The account name.
- Email: The account email address.
- Account ID: The user account ID.
Android GMX Webmail Messages
- ID: The ID of the email.
- Folder ID: The ID of the message.
- Folder Name: The folder ID.
- Account UID: The ID of the account that the mail came to or from.
- Subject: The subject of an email.
- Sender: The name of the sender.
- Email From: The email of the sender.
- Email To: The receiver of the mail.
- BCC: The addresses that get the BCC.
- CC: The addresses that get the CC.
- Date: The date that the email was sent or received in Unix Milliseconds.
- Body: Contains the path of the file of the body of the email if it exists.
- Text Body: The plain text content of the email.
- Has attachment: A flag to check if the email has an attachment.
Android GMX Webmail Attachments
- ID: The ID of the email.
- Content Type: The content type.
- Content Description: Content description.
- Local Path URI: Local path URI.
- Temporary Attachment URI: Temporary attachment URI.
- Attachment ID: Attachment ID.
- Content ID: Content ID.
Android GMX Webmail Contacts
- Contact Email: The contact email.
- Display Name: The contact display name.
- Times Contacted: The number of times contacted.
- Contact ID: The contact ID.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
