Investigating Android Mastodon
24/01/2025 Friday
Mastodon is an open-source social networking platform that offers an alternative to traditional social media sites. Its main distinguishing feature is its decentralized nature, meaning it is not controlled by a single individual or organization. Users on this platform can follow others and interact with people across any Mastodon instance by exploring suggestions or searching hashtags. They can also share their own posts, known as "toots."
Digital Forensics Values of Android Mastodon
People use social media accounts to share their ideas and connect with others who share similar interests. This means that collecting information from artifacts left behind by social media apps like Mastodon can provide valuable insights for digital forensic investigators. As illustrated in the parsers' section below, locally stored artifacts on Android devices contain sensitive data such as cached toots, account details, instance information, and search history. These collected data can assist in reconstructing user activities, establishing communication patterns, and identifying the user's interactions across Mastodon instances.
Location of Android Mastodon
Android Mastodon artifact can be found at the following locations:
*/org.joinmastodon.android/databases/*.db
*/org.joinmastodon.android/files/*.json
Analyzing Android Mastodon Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Mastodon artifacts from Android machines’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Mastodon artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Mastodon artifacts in ArtiFast.
Android Mastodon Account Searches
- Search Date/Time: Timestamp.
- Username: Username.
- Display Name: Display Name.
- URL: URL.
- ID: ID.
Android Mastodon Notifications
- Notification Created Date/Time: Notification Created Date/Time.
- Notification From: Notification From.
- Notification Type: Notification Type.
- Reference URL: Reference URL.
- Text Content: Text Content.
- Visibility: Visibility.
- Status Created Date/Time: Status Created Date/Time.
- ID: ID.
Android Mastodon Timeline
- Timestamp: Timestamp.
- Account Name: Account Name.
- App Name: App Name.
- Text Content: Text Content.
- Attachment URL: Attachment URL.
- URL: URL.
- Boosted Account Name: Boosted Account Name.
- Boosted Content: Boosted Content.
- Boosted URL: Boosted URL.
- Replies Count: Replies Count.
- Boosted Count: Boosted Count.
- Favorites Count: Favorites Count.
- Visibility: Visibility.
- ID: ID.
Android Mastodon Account Details
- Created Date/Time: Created Timestamp.
- Name: Name.
- User Name: User Name.
- Display Name: Display Name.
- URL: URL.
- ID: ID.
- Followers Count: Followers Count.
- Following Count: Following Count.
- Bio: Bio.
- Avatar URL: Avatar URL.
- Instance Name: Instance Name.
- Favorite Alerts: Favorite Alerts.
- Follow Alerts: Follow Alerts.
- Mention Alerts: Mention Alerts.
- Poll Alerts: Poll Alerts.
- Boost Alerts: Boost Alerts.
- Is Bot: Is Bot.
- Is Discoverable: Is Discoverable.
- Is Locked: Is Locked.
- Is Suspended: Is Suspended.
Android Mastodon Instance Details
- Last Updated Date/Time: Last Updated Date/Time.
- URI: URI.
- Title: Title.
- Description: Description.
- Version: Version.
- User Count: User Count.
- Status Count: Status Count.
- Invites Enable: Invites Enable.
- Registrations Enabled: Registrations Enabled.
- Admin Contact Email: Admin Contact Email.
- Owner: Owner.
- Thumbnail: Thumbnail.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
