Google App Activity (reflection_gel_events.db)

Location

Description

SQLite database used by the Google Search app (Google Quick Search Box) to store user activity events for the Google Now feed and Discover features. Contains protobuf-encoded event records capturing app usage events, Google Search queries, Google Assistant interactions, web page visits, and contextual suggestions presented to the user.

Forensic Value

The reflection_gel_events database aggregates user activity across multiple Google services into a single artifact, often containing search queries, Assistant voice command transcriptions, and web activity that may not appear in Chrome history. The protobuf-encoded events require specialized decoding but can yield timestamped records of Google searches performed through the home screen widget or voice interface. Google Assistant interactions may include transcribed voice commands and responses, providing evidence of spoken requests. This database frequently retains data for extended periods, offering a long-term activity timeline.

Tools Required

Collection Commands

adb pull /data/data/com.google.android.googlequicksearchbox/databases/reflection_gel_events.db /forensics/output/

python3 aleapp.py -t tar -i /path/to/extraction -o /forensics/output/

adb shell dumpsys activity provider com.google.android.googlequicksearchbox > gsb_dump.txt

Collection Constraints

• •Availability depends on Android version, OEM build, encryption state, privilege level, and whether the collection was logical, rooted, or full-filesystem. OEM-specific builds may move or rename stores.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References