Investigating Android Truth Social
17/01/2025 Friday
Truth Social is a social media platform founded by former President Donald J. Trump. The claimed goal behind creating this platform is to create an alternative to mainstream platforms like Twitter and Facebook. It aims to provide a space for free speech, emphasizing a commitment to "uncensored" user expression. Truth Social operates under Trump Media & Technology Group (TMTG), with a mission to challenge what it describes as Big Tech's monopoly on information flow.
Digital Forensics Value of Android Truth Social
Android Truth Social has significant digital forensic value for investigating user activities, communications, and content. Key artifacts include user profiles and media files. Metadata like timestamps and geolocation help reconstruct timelines of events. Media files and shared links can reveal additional evidence, including file origins and external threats. It supports investigations into harassment, disinformation, influence networks, and cybercrime.
Location of Android Truth Social Artifacts
Android Truth Social artifacts can be found at the following locations::
data/data/com.truthsocial.android.app/files/.com.google.firebase.crashlytics.files.v2_com.truthsocial.android.app/open-sessions
data/data/com.truthsocial.android.app/cache/image_cache
Analyzing Android Truth Social Artifacts with ArtiFast
This section will discuss using ArtiFast to extract Android Truth Social artifacts from Android device files and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Truth Social artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Truth Social artifacts in ArtiFast.
Android Truth Social Account Information
- Account Name: The account name.
- User ID: User identifier.
- App Version: The version of the Truth Social application installed on the user’s phone.
- App Display Version: The display version of the application.
- Device Model: The model of this device.
- App Identifier: The Truth Social unique identifier.
- Is Jailbroken: Indicates whether the application is jailbroken or not.
- Device Manufacturer: The manufacturer of the device.
- Device Model Class: The device model class.
- App Installation UUID: The installation UUID of the application.
- OS Version: The operating system where this session started.
Android Truth Social Cached Images
- Date/Time: The date and time of modification of the image file (UTC).
- Content Type: The cache file content type.
- File Size: The cache file size.
- File Name: The file name.
- File Path: The location of the file in local storage.
- Creation Date/Time: The date and time this file was created (UTC).
For more information or suggestions please contact: ekrma.elnour@forensafe.com
