DOCSLIB.ORG

Google Search Bar & Search Term History

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Google Search Bar & Search Term History DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? Joshua Hickman Published on: May 26, 2020 License: Creative Commons Attribution 4.0 International License (CC-BY 4.0) DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? Synopsis Forensic question: What information can be located regarding searches conducted in the Google search bar? OS Version: Nougat (8.55.6.21) Oreo (8.91.5.21) Tools: WinHex, Version 19.7 (Specialist License) Cellebrite UFED 4PC, Version 7.10.1.1080 (Nougat) Cellebrite UFED 4PC, Version 7.12.1.100 (Oreo) DCode Version 4.02a Google Protocol Buffers, Version 3.7.1 DB Browser for SQLite, Version 3.10.1 Cellebrite Physical Analyzer, Version 7.15.1.1 Cellebrite Physical Analyzer, Version 7.16.0.93 Internet Evidence Finder, Version 6.23.1.15677 2 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? Introduction Search history. It is an excellent way to peer into someone’s mind and see what they are thinking at a particular moment in time. In a court room, search history can be used to show intent (mens rea). There are plenty of examples where search history has been used in court to establish a defendant’s intent. Probably the most gruesome was the New York City Cannibal Cop trial, where prosecutors used the accused’s search history against him. Of course, there is a fine line between intent and protected speech under the First Amendment. Over the past month and a half I have published a couple of blog posts dealing with Google Assistant and some of the artifacts it leaves behind, which you can find here and here. While poking around I found additional artifacts present in the same area that have nothing to do with Google Assistant: search terms. While I wasn’t surprised, I was; after all, the folder where this data was found had “search” in the title (com.google.android.googlequicksearchbox). The surprising thing about these search terms is that they are unique to this particular area in Android; they do not appear anywhere else, so it is possible that you or I (or both) could have been missing pertinent artifacts in our examinations (I have missed something). Conducting a search via this method can trigger Google Chrome to go to a particular location on the Internet, but the term used to conduct the search is missing from the usual spot in the History.db file in Chrome. My background research on the Google Search Bar (as it is now known) found that this feature may not be used as much as, say, the search/URL bar inside Chrome. In fact, there are numerous tutorials online that show a user how to remove the Google Search Bar from Android’s Home Screen, presumably to make more space for home screen icons. I will say, however, that while creating two Android images (Nougat and Oreo), having that search bar there was handy, so I can’t figure out why people wouldn’t use it more. But, I digress… Before I get started there are a few things to note. First, the data for this post comes from two different flavors of Android: Nougat (7.1.2) and Oreo (8.1). The images can be found here and here, respectively. Second, the device used for each image was the same (LG Nexus 5X), and it was rooted both times using TWRP and Magisk. Third, I will not provide a file structure breakdown here as I did within the Google Assistant blog posts. This post will focus on the pertinent contents along with content markers within the binarypb files. I found the binarypb files related to Google Search Bar 3 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? activity to contain way more protobuff data than those from Google Assistant, so a file structure breakdown is impractical here. Finally, I thought it might be a good idea to give some historical context about this feature by taking a trip down memory lane. A Quick Background Back in 2009 Google introduced what, at the time, it called Quick Search Box for Android for Android 1.6 (Doughnut). It was designed as a place a user could go to type a word or phrase and search not only the local device but also the Internet. Developers could adjust their app to expose services and content to Quick Search Box so returned results would include their app. The neat thing about this feature was that it was contextually/location aware, so, for example, I could type the word “weather” and it would display the weather conditions for my current location. All of this could occur without the need of another app on the phone (depending on the search). Google Quick Search Box – circa 2009. 4 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? Showtimes…which one do you want? Prior to Google Assistant, Quick Search Box had a vocal input feature (the microphone icon) that could execute commands (e.g. call Mike’s mobile) and that was about it. Compared today this seems archaic, but, at the time, it was cutting edge. 5 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? Yes, I’m listening. Fast forward three years to 2012’s Jelly Bean (4.1). By that time Quick Search Bar (QSB) had been replaced by Google Now, Google’s search and prediction service. If we were doing Ancestry.com or 23andMe, Google Now would definitely be a genetic relative of Google Search Bar/Google Assistant. The resemblance is uncanny. Mom, is that you? Google Now in Jelly Bean. The following year, Kit Kat allowed a device to start listening for the hotword “Ok, Google.” The next big iteration was Now on Tap in 2015’s Marshmallow (6.x), and, with the arrival of Oreo (8.x) we have what we now know today as Google Assistant 6 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? and the Google Search Bar (GSB). Recently in Android Pie (9.x) GSB moved from the top part of the home screen to the bottom. Google Search Bar/Google Assistant at the bottom in Android Pie (9.x). As of the Fall of 2018 Nougat and Oreo accounted for over half of the total Android install base. Since I had access to images of both flavors and conducted research on both, the following discussion covers both. There were a few differences between the two systems, which I will note, but, overall, there was no major divergence. To understand where GSB lives and the data available, let’s review… 7 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? Review Time GSB and Google Assistant are roommates in both Nougat and Oreo; they both reside in the /data/data directory in the folder com.google.android.googlequicksearchbox. See Figure 1. Figure 1. GSB & Google Assistant’s home in Android. This folder holds data about searches that are done from GSB along with vocal input generated by interacting with Google Assistant. The folder has the usual suspect folders along with several others. See Figure 2 for the folder listings. Figure 2. Folder listing inside of the googlequicksearchbox folder The folder of interest here is app_session. This folder has a great deal of data, but just looking at what is here one would not suspect anything. The folder contains several binarypb files, which are binary protocol buffer files. These files are Google’s home- grown, XML-ish rival to JSON files. They contain data that is relevant to how a user interacts with their device via Google Assistant and GSB. See Figure 3. Figure 3. binarypb files (Nougat) A good deal of the overall structure of these binarypb files differ from those generated by Google Assistant. I found the GSB binarypb files not easy to read compared to the Google Assistant files. However, the concept is similar: there are markers that allow an examiner to quickly locate and identify the pertinent data. 8 DFIR Review Google Search Bar & Search Term History - Are You Finding Everything? A Deep Dive To start, I chose 18551.binarypb in the Nougat image (7.1.2). This search occurred on 11/30/2018 at 03:55 PM (EST). The search was conducted while the phone was sitting on my desk in front of me, unlocked and displaying the home screen. The term I typed in to the GSB was “dfir.” I was presented with a few choices, and then chose the option that took me to the “AboutDFIR” website via Google Chrome. The beginning of the file appears in Figure 4. Figure 4. Oh hello! While not a complete match, this structure is slightly similar to that of the Google Assistant binarypb files. The big takeaway here is the “search” in the blue box. This is what this file represents/where the request is coming from. The BNDLs in the red boxes are familiar to those who have read the Google Assistant posts. While BNDLs are scattered throughout these files, it is difficult to determine where the individual transactions occur within the binarypb files, thus I will ignore them for the remainder of the post. Scrolling down a bit finds the first area of interest seen in Figure 5. Figure 5. This looks familiar. In the Google Assistant files, there was an 8-byte string that appeared just before each vocal input. Here there is a four-byte string (0x40404004 – green box) that appears before the search term (purple box).
Load more

Recommended publications
  • Electronic Evidence Examiner
    2 Table of Contents About Electronic Evidence Examiner How To .......................................................................12 How to Work with Cases .........................................................................................................13 How to Create New Case .......................................................................................................13 How to Enable Automatic Case Naming .................................................................................14 How to Define Case Name During Automatic Case Creation .................................................14 How to Open Existing Case....................................................................................................15 How to Save Case to Archive .................................................................................................16 How to Change Default Case Location ...................................................................................16 How to Add Data to Case ........................................................................................................17 How to Add Evidence .............................................................................................................18 How to Acquire Devices .........................................................................................................20 How to Import Mobile Data .....................................................................................................21 How to Import Cloud Data ......................................................................................................22
    [Show full text]
  • Ransomware and G Suite Business: What You Need to Know
    EBOOK Pull text goes here and bold some of the copy Ransomware and G Suite Business: What You Need to Know 1 | backupify.com Pull text goes here Theand boldRansomware some Problem of the copy Small to enterprise sized businesses face an enormous computer security challenge. They have hundreds -- or thousands -- of accounts to manage. In most cases, not every account holder will ! have the training or knowledge to take the proper measures to keep the organization’s data secure. With multiple accounts, there’s a pretty good chance that someone will encounter malware. It just takes an accidental click or two to download and install. Ransomware encrypts your files then demands payment. The ransom notification promises that if you pay, you’ll receive an unlock code to decrypt your files. Of course, you have to pay in a hard-to- trace cryptocurrency. If you don’t pay, some variants delete your files -- a few at first, then more over time. Don’t think a reboot will help: that just spurs the software to delete your data. And even if you pay, you might not get your data back. You have absolutely no reason to trust the thieves behind the ransomware. Once they have your money, why would they bother to give you an unlock code that works? And why would you expect ransomware distributors to create bug-free code? There’s a decent chance they’re effective criminals, but lousy coders. Cloud apps and storage, such as G Suite and Google Drive, offer some protection from ransomware. New files you create online will be safe.
    [Show full text]
  • Transfer Your Gmail and Drive with Google Takeout for Schools
    Transfer your Gmail and Drive with Google Takeout for Schools You can take it with you! Transfer your Gmail and Drive with Google Takeout for Schools Change is a part of life: Maybe you are a high school senior or a college student and you are graduating. Or perhaps you are a student who is moving to a new school. You might be a teacher who is taking a job at a new school district. Or maybe you are an educator who is retiring after many years of service. In each situation, it is very possible you may have a Google account. G Suite may be used at your high school, your college, and any one of your jobs. So what happens to your Google account when you graduate high school, graduate college, move from one job to another, and eventually retire? You will have built up years of emails, documents, slideshows, and much more. Is there an easy way to take all those files and all that data with you? What would be great would be a simple tool to copy all of your files to a different Google account (such as your personal Gmail account). Well, thankfully we have that with Google Takeout for Schools. This is a very simple and free tool that will copy the emails and Drive files from your school account over to either a personal Gmail account or another G Suite for Education account. See below for a video demonstrating all the steps, as well as written direction on the process. Tutorial Video (9 minutes) Directions for Copying Gmail and Drive For the first step you need to have two different Google accounts, the source account that you are copying from and the destination account that you are copying to.
    [Show full text]
  • Cloud Forensics: Google
    Hackinbo 2018 Cloud Forensics: Google Extracting Google Account data © ElcomSoft Ltd. www.elcomsoft.com 1 Google Forensics In This Presentation § Cloud and Over-the-Air Acquisition § Synchronized data § Passwords § Two-Factor Authentication 2 Cloud Forensics Cloud Acquisition: Why? • Helps dealing with locked and encrypted devices • Android 6 and up encrypted by default • Google Account may contain more data than the phone itself • Last resort: may succeed where all other methods fail • Google collects information from all signed-in devices 3 Page 3 Cloud Forensics Cloud Acquisition Helps Bypass All of This: • Secure Lock Screen • Locked Bootloader • Factory Reset Protection (FRP) • Full-Disk Encryption (FDE) and File-Based Encryption (FBE) • Device is broken, wiped, or locked 4 Page 4 Google Forensics Google: Why Cloud Forensics? • Tens of thousand device models • Several thousand manufacturers • Extreme platform fragmentation • Not every Android device is a Google device • Acquisition approaches vary Google Account acquisition • Single point of entry • Unified approach • Impressive amount of information 5 Page 5 Google Forensics Android Open Source vs. Google Mobile Services • Not every Android device is a Google device • AOSP does not mean GMS • Google collects data from other sources if user signs in to: • Chrome browser • Google Maps • Gmail • Google Search • Including competing platforms 6 Page 6 Google Forensics Google Collects Data from Multiple Sources • Multiple devices • Mac • Windows • iPhone • iPad + 23 more • …and Android
    [Show full text]
  • Google Data Collection —NEW—
    Digital Content Next January 2018 / DCN Distributed Content Revenue Benchmark Google Data Collection —NEW— August 2018 digitalcontentnext.org CONFIDENTIAL - DCN Participating Members Only 1 This research was conducted by Professor Douglas C. Schmidt, Professor of Computer Science at Vanderbilt University, and his team. DCN is grateful to support Professor Schmidt in distributing it. We offer it to the public with the permission of Professor Schmidt. Google Data Collection Professor Douglas C. Schmidt, Vanderbilt University August 15, 2018 I. EXECUTIVE SUMMARY 1. Google is the world’s largest digital advertising company.1 It also provides the #1 web browser,2 the #1 mobile platform,3 and the #1 search engine4 worldwide. Google’s video platform, email service, and map application have over 1 billion monthly active users each.5 Google utilizes the tremendous reach of its products to collect detailed information about people’s online and real-world behaviors, which it then uses to target them with paid advertising. Google’s revenues increase significantly as the targeting technology and data are refined. 2. Google collects user data in a variety of ways. The most obvious are “active,” with the user directly and consciously communicating information to Google, as for example by signing in to any of its widely used applications such as YouTube, Gmail, Search etc. Less obvious ways for Google to collect data are “passive” means, whereby an application is instrumented to gather information while it’s running, possibly without the user’s knowledge. Google’s passive data gathering methods arise from platforms (e.g. Android and Chrome), applications (e.g.
    [Show full text]
  • Students: Transfer/Download Your Google School Content
    Students: Transfer/Download Your Google School Content Student Google Drive Files cannot be recovered after graduation or after a student leaves the district. School G Suite accounts are closed when students are no longer enrolled. This means that once you graduate or leave the district, you will no longer have access to your files and resources in G Suite unless you take them with you. This process must be completed before graduation or leaving Elwood Community School Corporation. Follow these instructions to transfer your Google Drive files and information: 1. Have or create a personal Google account. a. If needed, click here to create a Google account (instructions) b. Having trouble? Visit the Google Help Center 2. While you are logged into your Elwood Community School Corporation Google account, click here and complete the following steps: a. Select the content you’d like to transfer b. Choose ‘send download link via e-mail’, one-time archive, .zip file, and the 2GB options, then click ‘Create Archive’ c. When the archiving finishes, visit your Elwood school email and retrieve the data from the link sent to you by Google Takeout d. Download the data directly to your device e. Sign out of your Elwood school account, then sign into your personal account, and upload the data to your personal account f. Click here for help Please Note: A personal Google account has 15 gigabytes of storage while school accounts have unlimited storage. If the documents from your school account will exceed this amount, you will need to download the documents separately or create multiple personal accounts.
    [Show full text]
  • ​Google Takeout to Transfer Drive & Gmail Content from School To
    ​Google Takeout to Transfer Drive & Gmail Content from School to Personal Account Google Takeout Service If you are leaving your school district, you can copy the contents of your Google Drive and transfer it to a personal Google account. Because files are copied, they will NOT be deleted from your school Google account, so it’s safe to do this process anytime. Video Tutorial Step by step instructions are available in this short tutorial video HERE. ​ ​ Preparing to Copy & Transfer Get organized Prior to transferring your files, take time to organize your folders and remove files you do not want to transfer. Once you are ready to transfer files using Google Takeout, your files will be copied into your personal account maintaining the same folder structure / organization as they have in your school account. If you have a large number of files, it will take some time for Google Takeout to copy the contents of your entire Google Drive. Transferrable Content What WILL be Transferred: ● Files in Folders in Google Drive that are OWNED by you ● Shared files that have been “Added to Drive” will be copied but the new file will NOT be shared with ​ ​ collaborators What will NOT Transfer: ● Images stored under “Google Photos” ● “Shared with Me” Files that have NOT been “Added to Drive” ​ ● Google Sites, Google Forms, Google MyMaps & other third party content in Drive Personal Google account You will need a personal Google / Gmail account (must end in @gmail.com) to transfer your files to. If you don’t already have one, visit https://accounts.google.com/SignUp to create your free account.
    [Show full text]
  • Before the National Telecommunications and Information Administration Washington, DC 20230
    Before the National Telecommunications and Information Administration Washington, DC 20230 In the Matter of ) ) Developing the Administration’s ) Docket No. 180821780–8780–01 Approach to Consumer Privacy ) COMMENTS OF NEW AMERICA’S OPEN TECHNOLOGY INSTITUTE November 9, 2018 Eric Null Becky Chao New America’s Open Technology Institute 740 15th St NW, Suite 900 Washington, D.C. 20005 Introduction New America’s Open Technology Institute (OTI) files these comments in response to the National Telecommunications and Information Administration’s (NTIA) Request for Comments on Developing the Administration’s Approach to Consumer Privacy (RFC).1 The desired outcome of the NTIA’s proposal is a “reasonably informed user.”2 OTI’s comments will focus on two issues. First, data minimization, user controls, and strong enforcement should be central pillars of the NTIA’s approach to consumer privacy. Data minimization provides many benefits to both users and companies. It reduces the amount of information companies have to convey to their users, it reduces risks associated with collecting and storing data including harms brought about by data breaches, and it reduces company costs associated with data processing. User controls are also necessary for “reasonably informed users” to control how their data is collected and used. And strong enforcement is necessary to ensure that companies have incentives to follow the law. Second, some of the goals identified by the NTIA are contradictory or misplaced. Primarily, while the NTIA’s proposal focuses on a comprehensive approach that would apply to all sectors, it should allow for different requirements for broadband providers—there are salient differences between broadband providers and online companies that necessitates a different approach.
    [Show full text]
  • Download History Chrome Android
    download history chrome android How to Recover Deleted Browsing History on Android Devices? Eyeing for the ways to recover deleted browsing history on android? Don’t know what to do? Follow our guide and learn to recover browsing data from your android device with Recoverit Data Recovery App. David Darlington. Jul 05, 2021 • Filed to: SD Card Solutions • Proven solutions. Our phone's browser history comes in extra handy when we intend to access a website that contains valuable information quickly. It should also be kept into account that Android phones have a universal issue with handling storage space, which tends to get annoying after a certain time. Sometimes for the sake of opening up storage space within the smartphone, we inadvertently erase all the data of our built-in apps such as the Chrome browser. Such an action leads to the direct deletion of browser history and account information that holds that history. And if you do now know how to recover deleted browsing history on android, then with this article, you will know the two simple methods to recover and extract browser history from the abyss. Part 1: Can Android Browsing History be Recovered Once It is Deleted? Through the convenience of modern technology, we can sync everything from personal files to browsing history across multiple devices. This technique of data synchronization within the Android phones allows you to save all the data on your Google account and other Google-based facilities such as Google Drive. It also plays a pivotal role in recovering such files or browsing data when you want to get them back in case of accidental deletion.
    [Show full text]
  • Q3 2017 Internet & Digital Media Market Snapshot
    STRICTLY PRIVATE & CONFIDENTIAL Q3 2017 Internet & Digital Media Market Snapshot Robert Berstein Frank Cordek Managing Director Director [email protected] [email protected] www.signalhill.com Baltimore│Bangalore│Boston │ Mumbai│Nashville│NewYork│Reston│San Francisco Table of Contents I. Public Company Universe and Trading Statistics II. Mergers and Acquisitions Activity III. Private Placement Activity IV. IPO Activity Strictly Private & Confidential 2 Quarterly Summary Public Company Trading Statistics1 M&A Activity 6.0x $32,000 120 4.9x 5.0x 2 96 4.1x 100 4.0x $24,000 of DealsNumber 4.0x 3.6x 3.7x 3.5x 72 80 3.0x 57 3.1x $16,000 48 51 60 2.5x 2.0x 2.8x 2.4x 2.3x 2.2x 40 3 EV / CY'17ERevenue $8,000 21 1.0x 20 Aggregate Deal Value ($M)Value DealAggregate 0.0x Q3 2016 Q3 2017 Q3 2016 Q3 2017 Q3 2016 Q3 2017 $0 0 Q3 2016 Q3 2017 Q3 2016 Q3 2017 Q3 2016 Q3 2017 Internet Content & Services e-Commerce Interactive Marketing & Marketing Services Internet Content & e-Commerce Interactive Marketing & Services Marketing Services Median Mean Private Placement Activity4 IPO Activity $4,000 40 34 2 $3,500 35 $32.00 28 $32.00 $3,000 30 of DealsNumber $26.00 $26.54 $2,500 21 25 $25.09 $24.00 $2,000 20 14 $1,500 13 15 $16.00 $15.00 9 3 $14.00 $13.56 $1,000 10 $13.00 $11.50 Aggregate DealValue ($M) $500 5 $8.90 $8.00 $0 0 Q3 2016 Q3 2017 Q3 2016 Q3 2017 Q3 2016 Q3 2017 Internet Content & Services e-Commerce Interactive Marketing & $0.00 Marketing Services RDFN DESP SECO ROKU ROVIO Offer Price Price as of 9/30/17 Source: Signal Hill Database
    [Show full text]
  • Google Maps Documents and Data
    Google Maps Documents And Data Vassili oversimplify cephalad. Scotopic Sim nibbing jocosely or spindles boundlessly when Frank is equivocal. Bimillenary and tonsured Lynn never psychs his came! Windows you currently the maps data includes google maps or other areas for use of granularity of these types of new website, descriptions of up This will delete podcasts from your remedy after data have finished listening to them. Zoom in closer when you employ to herself a map with details that plaque you both see individual streets. Google could gift him. The knock is basically a private browsing mode. You face longer leash to opt out explicitly, you must drop a billing account, that a handbook of sanction or an order does comply. Trip visit from third parties is not cost effective than travel diaries or roadblock studies. We have added a random on loading of the script here. If you choose this suppose, a single offline map can me more common a gigabyte of storage depending on the size of thoracic area. Bull World Health Organ. The funny idea is that apple seems to completely disagree. Our investments in both fixed rate and floating rate interest earning securities carry a gait of table rate risk. The other method is set make a static snapshot of rate data, safe may i able focus quickly rebuild the entire package each update. Free up device storage, such as Gmail or Google Photos, and prevent further supported by us being primarily responsible approach our customers and someday a level of although in establishing pricing. Use only if state road is permanently closed.
    [Show full text]
  • What Google Knows About You and Your Devices (And How to Get It) Vladimir Katalov Elcomso Ltd
    What Google knows about you and your devices (and how to get it) Vladimir Katalov ElcomSo0 Ltd. www.elcomso.com What Google knows about you Research mo;va;ons • Curiosity • Privacy • The right to know • Government surveillance • Forensics • Backup and recovery Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 2 What Google knows about you What this presentaon is NOT about • Hacking • Accessing someone else’ account • Compromising Google • Criminal acRviRes • Profit Most informa,on used for this research is public Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 3 What Google knows about you Desktop vs Mobile forensics Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 4 What Google knows about you Smartphone sales Source: Gartner, August 2015 Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 5 What Google knows about you Enterprise tablet market Source: Q2’2015 Mobility Index Report Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 6 What Google knows about you Mobile vs Cloud forensics Google mail • 900 million users (May’2015) • Monthly unique users: 90 million (2014) • Percentage of Americans using Gmail: 24% (2013) • Gmail app downloads from Google Play: 1 billion (2014) • Percentage of Gmail users working on mobile device: 75% (2015) Google Chrome • Google Chrome users: 1 billion (2015) • Percentage of web browser usage: 35% (2013) Android Apple iCloud • Introduced in Oct 2011 with iOS 5 • Number of Android devices: 1 billion (2013)
    [Show full text]