Testing the harmonised digital forensic investigation process model-using an Android mobile phone

Abstract

Mobile forensics is a branch of digital forensics relating to the recovery of digital evidence from mobile devices under forensically sound conditions. Mobile forensics is considered to be at an infant stage with different investigation process models being applied. The biggest challenge in many of the available digital forensic investigation process models lies in their lack of testing before being fully applied to mobile forensics. Furthermore, for any proposed digital forensic investigation process model to be approved by the scientific community, it has to be tested. The Harmonised Digital Forensic Investigation (HDFI) process model is currently in the working draft stage towards becoming an international standard for digital forensic investigations (ISO/IEC 27043), thus the need for its testing. In this paper, the (HDFI) process model is tested using an Android mobile phone. The selection of an Android mobile phone is motivated by the fact that Android mobile phones have the greatest share of the mobile market index. In the last three years, for example, the market share index for mobile phones put Android mobile devices at 75% of the entire smartphone market. Through observing the findings of the test using an Android mobile phone, this paper demonstrates that conducting mobile forensics using the HDFI process model produces satisfactory results.