Investigating Samsung Clipboard
10/05/2024 Friday
Coping/Cutting and pasting is a feature that is available in almost all electronic devices such as computers, smartphones, tablets, etc. The clipboard is the key term that allows this feature to exist, and it is a space in memory that temporarily stores copied/cut content from one memory location to be pasted on another memory location. When the user copies/cuts and pastes on his/her Samsung device, he/she is using the clipboard. The copied/cut content can be text, images, and links and it can happen across different apps and contexts on the device. Additionally, Samsung devices often offer extended features like the ability to sync clipboard content across multiple devices or access clipboard history for retrieving previously copied items.
Digital Forensics Value of Samsung Clipboard
Retrieving Samsung Clipboard history and screenshots holds significant Digital Forensics Value as it provides forensic analysts with valuable insights into user activities and communications on Samsung devices. Accessing the Clipboard history allows analysts to view copied content, including text and links, which potentially uncover relevant evidence for investigations. Additionally, examining screenshots captured on the device can reveal visual evidence of user behavior, applications in use, and potentially sensitive information exchanged.
Location of Samsung Clipboard Artifacts
Samsung Clipboard artifacts can be found at the following location:
/data/*/com.samsung.android.honeyboard/*
Analyzing Samsung Clipboard Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Samsung Clipboard artifact from Android devices' files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Samsung Clipboard artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Samsung Clipboard artifact in ArtiFast.
Samsung Clipboard History
- Copied Date/Time: The date and time when this item has been copied to the clipboard.
- ID: The unique identifier for this clipboard item.
- Type: The type of this clipboard item.
- Content: The content of this clipboard item.
- Mime Type: The MIME type of this clipboard item if applicable.
- App UID: The unique identifier of the application where this clipboard activity has happened.
Samsung Clipboard Screenshots
- Created Date/Time: The created date/time of this screenshot file.
- Taken Date/Time: The date/time when this screenshot has been taken.
- Last Modified Date/Time: The last modified date/time of this screenshot file.
- Size: The size of this screenshot file in bytes.
- File Path: The file path of this screenshot file.
- File Name: The file name of this screenshot file.
- Image Data: The actual image bytes in Base64 encoded format.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
