In working through some sample evidence during training I came across that Digital Wellbeing, specifically Samsung's iteration of it, tracks when a device's timezone changes. I didn't see this anywhere in Josh Hickman's excellent blog but I know it's been part of questions in previous CTF challenges.
The database in question can be found at path:
/data/data/com.samsung.android.forest/databases/dwbCommon.db*
The table in question is the Logging table. There is more to unwrap here (maybe for a future blog) but today's focus is specifically on the timezone changes. If we filter the "key" column we can see some entries that show previous and new timezones as well as the timestamp when these events occurred.
 | ||
| Figure 1: Logging table filtered on timezone A simple query to filter and reorganize things, and a few lines with Python turns this into a nice little output from ALEAPP.
|
