Investigating Android Google Meet
06/06/2025 Friday
Google Meet is a video conferencing and online meeting application
developed by Google. The App is resulted from merging two previously
available Apps: Google Duo and Google Meet. It is available free of
charge and is designed to support a wide range of use cases, including
personal communication, remote education, and professional business
meetings. One of the key advantages of Google Meet is its accessibility.
The platform supports most major web browsers, eliminating the need for
dedicated software installation, and is compatible with both Android and
iOS operating systems via its mobile app.
Digital Forensics Values of Android Google Meet
Android Google Meet holds significant importance in digital forensics.
The parsers developed to extract data from Its leftover artifacts can be
used to extract details about meetings attended by the user, calls made,
files exchanged, and information about other participants. These details
may contain valuable information that can be used to reconstruct
timelines and understanding the user behavior during specific events.
Location of Android Google Meet
Android Google Meet artifacts can be found at the following location:
*/com.google.android.apps.tachyon/databases/tachyon.db
Analyzing Android Google Meet Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Google
Meet artifacts from Android machines’ files and what kind of digital
forensics insights we can gain from the artifact..
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select Android
Google Duo artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Google Meet artifacts in ArtiFast.
Android Google Duo Calls
- Partner ID: The partner ID, can be a phone number or email address.
- Activity Type: The type of activity that occurred.
- User ID: This phone user ID, can be a phone number or email address.
- Activity Date/Time: The date/time when this activity has been occurred.
- Call Status: Indicates whether the call has been missed or answered.
- Call Direction: Indicates whether this is an outgoing or incoming call.
Android Google Duo Users
- Last Updated Date/Time: The date/time when this user information has been updated.
- ID Type: Indicates whether the user ID is a phone number or an email.
- User ID: The user ID, can be a phone number or email address.
- User Name: The user display name.
Android Google Duo Messages
- Sent Date/Time: The date/time when this message has been sent.
- Received Date/Time: The date/time when this message has been received.
- Seen Date/Time: The date/time when this message has been seen.
- URI: The file path on the local phone to the image file.
- Sender ID: The sender ID, can be a phone number or email address.
- Recipient ID: The recipient ID, can be a phone number or email address.
- Size: The size of the content sent or received in this message.
- Is Saved: Indicates whether or not the message was saved to the phone.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
