Investigating Android Samsung Browser
04/10/2024 Friday
Samsung has started rolling out the latest version of its Android-based web browser, featured on the newest Galaxy smartphones. Since 2012, this browser has replaced the Android Stock browser on Samsung Galaxy devices, offering an experience tailored to Samsung hardware. However, the Samsung Browser is not limited to Galaxy devices; it is also available for download on the Google Play Store, making it accessible on other Android devices as well.
Digital Forensics Value of Android Samsung Browser
Samsung is the top manufacturer of smartphones, holding the biggest share in the smartphone market. Hence, mobile device investigators are increasingly likely to encounter Samsung devices, and with them, the Samsung Browser. Like other web browsers on Android devices, the Samsung Browser stores internet history, cookies, and web page cache files.
Location of Android Samsung Browser Artifacts
Android Samsung Browser artifacts can be found at the following location:
/data/com.sec.android.app.sbrowser/
Analyzing Android Samsung Browser Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Samsung Browser artifact from Android devices' and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Samsung Browser artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Samsung Browser artifact in ArtiFast.
Samsung Browser Web History
- URL: The URL of the website.
- Title: The title of the website.
- Visit Count: Shows how many times the user has visited the website.
- Typed Count: Unknown.
- Last Visit Time: The last time the user visited the website.
- Hidden: Indicates whether the URL is hidden or not.
Samsung Browser Downloadeds
- File Name: The name of the file (can be extracted from the last section of the target path).
- Target Path: The location where the download was saved.
- Start Time: The download start time.
- Received Bytes: The bytes that were downloaded.
- Total Bytes: The file size of the download.
- End Time: The download end time.
- Opened: Whether the file was opened (1 = opened, 0 = not opened).
- Last Access Time: The last time the file was accessed after the download (WebKit/Chrome timestamps).
- Referrer: The referrer of the website that provided the file.
- Tab URL: The tab URL that referred to the website.
- URL: The URL of the file that was downloaded.
Samsung Browser Cookies
- Creation UTC: The date and time the cookie was created.
- Host Key: The host/website domain that created the cookie.
- Name: The name of the cookie.
- Value: The value of the cookie.
- Path: The path of the cookie.
- Expires UTC: The date and time the cookie will expire.
- Is Secure: Indicates if this cookie is secure or not.
- Is HttpOnly: Indicates if the cookie is used only with HTTP.
- Last Access UTC: The date and time the cookie was last accessed.
- Has Expires: Indicates if the cookie has an expiration date.
Samsung Browser Search Engine
- Title: The title name of the search engine website.
- URL: The link URL of the search engine website.
- Image: The search engine website's icon (BLOB) in PNG format.
- Last Updated: The last time the user updated the search engine list.
- Image URL: The URL of the search engine website's icon.
Samsung Browser Top Sites
- URL: The URLs of the top sites.
- URL Rank: The priority or rank of the URL.
- Title: The website's title name.
- Redirects: The redirected URL.
Samsung Browser Logins
- Origin URL: The URL of the login page.
- Username Element: The element/field for the username value.
- Username Value: The username entered.
- Password Element: The element/field for the password value.
- Password Value: The password entered (BLOB), almost encrypted.
- Date Created: The date and time that data was created.
- Date Last Used: The date and time that data was used.
- Blacklisted by User: Indicates if this page is blacklisted by the user (1 = yes, 0 = no).
- Times Used: How many times the user logged into this website.
Samsung Browser Keywords Search Terms
- Term: The keyword search term that the user entered.
- URL: The URL of the keyword search.
- Title: The website title.
- Last Visit Time: The last time the user visited the site (WebKit/Chrome timestamps).
Samsung Browser Autofill
- Name: The name of the autofill value.
- Value: The value.
- Value Lower: The count of the autofill.
- Date Created: The date and time when the autofill value was created (unix time).
- Date Last Used: The last date and time when the autofill value was used (unix time).
- Count: How many times that value has been used.
Samsung Browser Credit Card
- Name on Card: Name on user's card.
- Expiration Month: Expiration month of card.
- Expiration Year: Expiration year of card.
- Card Number (Encrypted): Encrypted card number.
- Date Modified: Modified date.
- Origin: Unknown.
- Use Count: How many times the user has used the card.
- Use Date: The date the user used this card.
- Billing Address ID: User address ID.
- Nickname: User's nickname.
Samsung Browser Favicons
- Page URL: URL page that locates the favicon.
- Last Updated: Last time that favicon got updated.
- Image Data: Binary data of that image (PNG).
- Width: Icon width.
- Height: Icon height.
- Last Requested: The last time that favicon was requested.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
