A Systematic Literature Review on Digital Forensic Investigation on Android Devices

Abstract

Mobile forensics, particularly in the Android ecosystem, is a rapidly evolving field that demands continuous advancements to address the growing complexity and diversity of mobile devices. This article emphasizes the importance of developing techniques for digitally analyzing Android smartphones, which dominate the smartphone market. The primary objective of this research is to contribute to the development of effective forensic investigation strategies tailored specifically for Android mobile devices, providing insights into the tools and methods used for this purpose. The objective of this study is to improve the precision and effectiveness of forensic examinations pertaining to Android mobile phones. It discusses the fundamental functionality of mobile devices as a source of digital evidence and provides an overview of tools and methodologies for collecting and analyzing such evidence. The importance of comprehending the hardware and software architecture of Android handsets in order to choose the right forensic tools is also highlighted in the article. Furthermore, it proposes future enhancements for Andriller, a popular digital forensic tool, to improve its effectiveness in Android forensic investigations. These enhancements include advancements in data extraction techniques, compatibility with new Android versions, support for additional data types, integration with advanced analysis methods, and addressing identified limitations. Additionally, the paper stresses the need for robust methodologies for conducting cloud forensics on Android devices, particularly in the context of data stored in cloud storage services. The proposed work aims to enhance the capabilities of Andriller and improve the efficiency of digital forensic investigations on Android devices.