Investigating Android Gettr
28/03/2025 Friday
GETTR is a social media platform founded by Jason Miller, a former
advisor to Donald J. Trump. Launched in 2021, it was created as an
alternative to mainstream platforms like Twitter, emphasizing free
speech and minimal content moderation. GETTR aims to provide a space for
open discussion, particularly catering to users who feel censored or
restricted by traditional social media sites. The platform promotes
itself as a hub for political discourse, news sharing, and unrestricted
expression.
Digital Forensics Value of Android Gettr
The digital forensics value of Android Gettr lies in its potential to
provide critical evidence related to user activity, communications, and
content shared on the platform. As a social media app emphasizing free
speech, it may contain data relevant to investigations involving
cybercrime, harassment, extremism, or disinformation campaigns. Forensic
analysis can uncover user profiles, posts, messages, metadata, and
behavioral patterns, aiding legal and investigative processes. This
makes Gettr a valuable source of information for law enforcement and
cybersecurity professionals.
Location of Android GETTR Artifacts
Android Gettr artifacts can be found at the following locations:
data/data/com.truthsocial.android.app/files/.com.google.firebase.crashlytics.files.v2_com.truthsocial.android.app/open-sessions
data/data/com.truthsocial.android.app/cache/image_cache
Analyzing Android Gettr Artifacts with ArtiFast
This section will discuss using ArtiFast to extract Android Gettr
artifacts from Android device files and what kind of digital forensics
insights we can gain from the artifacts.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select Android
Gettr artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Gettr artifacts in ArtiFast.
Android Gettr Users
- User Name: The user name.
- User ID: The User identifier.
- Device Model: The model of this device.
- Is Verified: Indicates whether the account is verified or not.
- Profile Picture URL: The user profile picture’s URL.
- Last Active Date/Time: The last date and time the user was last active.
- Account Type: The account type.
Android Gettr Notifications
- Date/Time: The date and time the notification was sent (UTC).
- Title: The notification message title.
- Notification ID: The notification identifier.
- Notification: The notification details.
Android Gettr Messages
- Sending Date/Time (UTC): The message sending date and time UTC.
- Deleted At Date/Time: The time and date when the message was deleted.
- Status: The status of this message.
- Has Attachments: Indicates whether the message has an attachment or not.
- Replied To Message ID: The ID of the replied-to message if exists.
- Last Update Date/Time: The last date and time the message was updated.
- Sender ID: The message sender ID.
- Message ID: The message identifier.
- Chat ID: The chat Identifier.
- Message Content: The message body content.
Android Gettr Channels
- Date/Time: The date and time the channel information was modified (UTC).
- Members Information: The information of the channel members.
- Creator ID: The channel creator user identifier.
- Number of Participants: The number of the channel participants.
- Channel Type: The channel type.
- Channel ID: The channel identifier.
- Last Sent Message Date/Time: The time and date when the last message was sent.
- Created Date/Time: The date and time the channel was created.
Android Gettr Attachments
- Message ID: The ID of the replied-to message if exists.
- File Type: The attachment file type.
- File Size: The attachment file size.
- File Name: The attachment file name.
- File URL: The attachment file URL.
- MIME Type: The type of data stored in the attachment.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
