Android digital forensics

Abstract

Smartphones are exceedingly popular, with the Android platform being no exception. Also, the surge of applications available for such devices has revolutionized our lives, many of which process a significant amount of personal information. Instant Messaging applications are an excellent example of this. In addition to processing this information, there is a high likelihood that they store traces of it in local storage.Increasingly, smartphones are involved in law enforcement investigations. They may be found as evidence at the scene of a crime, and require forensic analysis. It has translated into strong demand for Android digital forensics. A critical stage in such an investigation is data acquisition. An investigator must extract the data (in a forensically sound way) before it can be analyzed. This paper provides a survey and analysis of many acquisition methods. In addition, we conduct our own experiment that showcases an excellent acquisition method in practice, and also shows our data analysis methodology as we analyze the private storage of two popular instant messaging applications.