Investigating Android Aqua Mail
11/08/2023 Friday
Android Aqua Mail is one of the email applications designed to help users manage and organize their email accounts effectively on Android devices. It provides a user-friendly interface and a range of features to enhance the email experience. Those features include, but are not limited to, multi-account support, calendar integration, intelligent sorting, and advanced folder management
Digital Forensics Value of Aqua Mail
Android Aqua Mail artifacts, like those from any other email application, can hold significant value in a digital forensic investigation. These artifacts can provide crucial insights into a user's activities, communications, and interactions, making them relevant for various types of cases. Investigators can analyze email headers, message bodies, sender/receiver information, and timestamps to reconstruct conversations and understand the context of communications.
Location of Android Aqua Mail Artifacts
Android Aqua Mail App artifacts can be found at the following locations:
org.kman.AquaMail/databases/Messages.sqldb
Analyzing Android Aqua Mail Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Aqua Mail artifacts from Android machines’ files and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Aqua Mail artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Aqua mail App artifacts in ArtiFast.
Android Aqua Mail Messages
- Message ID: The message unique identifier.
- Subject: The message subject.
- Sent Date: The date when this message has been sent.
- From: The sender of the message.
- Reply To: reply to.
- To: The receiver of the message.
- Cc: The carbon copy’s receivers of the message.
- Bcc: The blind carbon copy’s receivers of the message.
- Flags: Indicates whether this message is flagged or not.
- Hide: Indicates whether this message is hidden or not.
- Is Unread: Indicates whether this message has been read or not.
- Is Deleted: Indicates whether this message has been deleted or not.
- Is Starred: Indicates whether this message is starred or not.
- Full Message: The message’s content.
- Attachments Size: The attachment size.
- Has Attachments: Indicates whether this message has attachments or not.
- Has Calendars: Indicates whether this message has calendars or not.
- Thread ID: The message’s thread ID.
- Sender: The message sender name.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
