Facebook Messenger (Android) App Media Files Share Tracking In past blog posts, I've stressed the importance of testing and validating information. This post is no different. It's imperative that as a digital forensic investigator, we test apps from the user's perspective and then analyze what happens to the data behind the scenes. I recently had a case which featured a specific media file artifact located in the "fb_temp" folder of the Facebook Messenger app. At first glance, the assumption would be that the user must have sent this media to someone using the app. But we all know what happens when we assume. Below is the testing I conducted and the information I found that can help you track whether files or media were actually shared in the app and when. FACEBOOK MESSENGER TESTING METHODOLOGY A video was located in the Facebook Messenger app’s fb_temp folder on an Android phone. Since “temp” denotes a temporary folder, it was necessary to test Faceboo...