Alexis Brignoni  Feb 27

🆕 #Android Samsung #Knox (Secure Folder) history log artifact in #ALEAPP.
🪵 SQLite database contains a log of items requested be moved in or out of the secure folder in Samsung Android devices.
👏 Thanks to HSI Digital Forensics Examiner Geovanny Perez for the discovery of this artifact.

#DFIR

Show threadTomWilsonYEG
@abrignoni
Perhaps I'm just being naïve but,
Doesn't ANY OS need some way to keep track of things toggled as secure?
Feb 27 at 11:41pmWeb
Show threadAlexis Brignoni  Feb 28

@CTHW Why would the OS use a SQLite database for it? At the end of the day, from an investigative standpoint, what's useful is the fact that it tells the examiner when the files were moved and from what account.

What the OS uses it for, if anything, I don't really care for. 🙂

Show threadTomWilsonYEGFeb 28

@abrignoni

Not sure what OS you use. Mine already knows all about me. I guess the issue is where/when that info is shared and why I will not use an Android based system as the business plan is based on selling my personal information …

Show threadAlexis Brignoni  Feb 28

@CTHW good luck finding any mobile device or modern Internet enabled service that doesn't do that already in some form.

My post has nothing to do with your concern but thanks sharing. 👍

Take care.