Investigating Android Proton Mail
28/02/2025 Friday
Proton Mail is a secure email service provider known for its strong
focus on privacy and encryption. Developed by the Swiss-based company
Proton AG, this email service is designed to protect user data with
end-to-end encryption, ensuring that only the sender and recipient can
access the contents of emails. Proton Mail also offers features like
self-destructing emails, two-factor authentication, and a user-friendly
interface.
Digital Forensics Value of Android Proton Mail
Android Proton Mail artifacts, like those from any other email
application, can hold significant value in a digital forensic
investigation. These artifacts can provide crucial insights into a
user's activities, communications, and interactions, making them
relevant for various types of cases. Investigators can analyze email
headers, message bodies, sender/receiver information, and timestamps to
reconstruct conversations and understand the communications context.
Location of Android Proton Mail Artifacts
Android Proton Mail artifacts can be found at the following location:
data/data/ch.protonmail.android/databases/db-mail
Analyzing Android Proton Mail Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Proton
Mail artifacts from Android machines’ files and what kind of digital
forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select Android
Proton Mail artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Proton Mail artifacts in ArtiFast.
Android Proton Mail Account Information
- User Name: This account’s user name.
- Passphrase: The passphrase.
- Is Active: Indicates whether this user account is active or not.
- User ID: The user’s identifier.
- Private Key: The private key.
- Email Address: The user’s email address.
- Display Name: The display name.
Android Proton Mail Attachments
- Message-ID: The message's unique identifier.
- Attachment Name: The attachment’s name.
- Attachment Type: The attachment’s type.
- Attachment Size: The attachment’s size.
- Is Uploaded: Indicates whether the attachment is uploaded or not.
Android Proton Mail Contacts
- User ID: The User’s unique identifier.
- Created Date\Time: The date and time when this account was created.
- Public Key: The user’s public key.
- Email Address: The user’s email address.
- User Name: The user name.
Android Proton Mail Emails
- Message-ID: The message's unique identifier.
- Message Type: The message’s MIME type.
- Subject: The message subject.
- Sent Date: The date when this message has been sent.
- Sender Name: The sender of the message.
- Sender Email: The sender email of the message.
- Reply To: reply to.
- To List: The receivers’ list of the message.
- CC List: The carbon copy’s receivers of the message.
- BCC List: The blind carbon copy’s receivers of the message.
- Flags: Indicates whether this message is flagged or not.
- Is Starred: Indicates whether this message is starred or not.
- Is Read: Indicates whether this message has been read or not.
- Is Deleted: Indicates whether this message has been deleted or not.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
