Investigating Android Playstore Search History
03/11/2023 Friday
The Android Play Store, officially known as Google Play, is a digital distribution service created and managed by Google. It serves as the official app store for devices running on the Android operating system. Users can browse and download a wide range of applications, games, movies, TV shows, music, and books directly to their Android smartphones, tablets, and other compatible devices.
Digital Forensics Value of Android Playstore Search History
Analyzing search queries executed by the device’s user on Playstore can be used to observe user's interests, preferences, and behaviors. Therefore, identifying the patterns in search history can indicate potentially malicious activities. Detecting unusual or suspicious search queries can assist in recognizing potential security threats or malware infections. This information could even be used to vindicate the device's user from those suspicious activities performed on her device.
Location of Android Playstore Search History Artifacts
Android Playstore Search History artifact can be found at the following location:
com.android.vending/databases/suggestions.db
Analyzing Android Playstore Search History Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Playstore Search History artifact from Android device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Playstore Search History artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Playstore Search History artifact in ArtiFast.
Android Play Store Search History
- Search Date: The date/time when this search has been performed.
- ID: Database row ID for this search.
- Query: The terms used in the search process.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
