As of Chrome version 86, Google introduced a new database to keep track of your video viewing called Media History. It can be located in the Default folder path for Chrome:Windows:C:\Users\<USERNAME>\App Data\Local\Google\Chrome\User Data\Default\Media HistoryAndroid:data\data\com.android.chrome\app_chrome\Default\Media History**Note: Edge and sBrowser both use Chromium as well so this artifact should reside in their... [Read More]

Files By Google is the default file organizer built into Google Pixel phones but can also be installed as an app through the Google Play Store (found here). Josh Hickman did a good amount of research with it's connections to the External.db database found on Android phones but didn't go... [Read More]

Previous (Android): Week 1 | Week 2 | Week 3 | Week 4Previous (Linux): Week 5 | Week 6 | Week 7 | Week 8Previous (Memory): Week 9 | Week 10 | Week 11 | Week 12Early last week, the final results for the Magnet Weekly CTF were revealed on a Zoom call, and by pure luck I leapt to the top of the list. I guess those 6 custom... [Read More]

UPDATE: Read Part 2 and Part 3!In an effort to continue to look for new mobile artifacts, one that I recently came across was the turbo.db located at the following path:data\data\com.google.android.apps.turbo\databases\turbo.dbIt's a simple SQLite database which makes parsing fairly easy using DB Browser to start. Opening it there was only... [Read More]

Previous (Android): Week 1 | Week 2 | Week 3 | Week 4Previous (Linux): Week 5 | Week 6 | Week 7 | Week 8Previous (Memory): Week 9 | Week 10 | Week 11The time has come, the final week of the Magnet CTF and the last week of examining Warren's memory file.Challenge 12 (Dec. 21-28) (30)What is the PID of the application where you might learn "how... [Read More]