This is found on Samsung devices and is stored in USERDATA/semclipboard/. The files are stored as “clips” and contain content of the clipboard. The clip files have been observed to contain text when the text is put on the clipboard (copied) or in cases where screenshots are taken, the path of the picture is copied to the clipboard. The “clips” are stored in HTML.

Relevant fields: 

  •  mTimestamp 

  •  mValue (when copied content is text or some other string) 

  •  mHTML 

  •  mInitBaseValue (path of picture when copied content is a screenshot) 

When screenshots are taken the folder will also contain a copy of the picture and a thumbnail version of the picture. The clip files are Java ArrayLists, which do not render well in text editors/hex viewers.  Physical Analyzer can render the whole file.  ALEAPP will pull timestamp and clipboard contents only. 

These artifacts can be specifically beneficial for passwords the user may have copied/pasted into apps, webforms, text message, etc. The data in these files is non-volatile.