Mobile Forensic Tools Research Articles

A Survey on Mobile Digital Forensic: Taxonomy, Tools, and Challenges

ABSTRACTModern time largely rely on mobile gadgets as a means of communication, and entertainment. These gadgets now plays a vital role in forensic analysis and criminal investigations as it store a plethora of private and sensitive data. Investigating feasible digital incidents and preserving mobile device security became crucial as the proliferation of mobile devices continues to influence modern society. In this survey; mobile threats, investigative process models for mobile forensics, evidence sources, forensics tools, and field problems are all covered in‐depth. Further, a comprehensive analysis examining the capabilities, features, and efficiency of available distinct mobile forensic tools namely Belkasoft, MOBILedit, and Magnet AXIOM for retrieving, analyzing, and presenting digital evidence is being presented. The objective of the study is to assist forensic investigators in choosing the best tool for specific investigations. The findings of our study reveals the complexity of mobile operating systems, investigative process supported with sources of evidence, and forensic tools which makes it clear that the area of mobile forensics is dynamic and require modern skill adaptation along and innovative development in future. Finally, the study presents current challenges encountered during mobile forensic investigations as researchers can enhance their procedures and tactics for mobile device examination and evidence extraction by fostering a greater knowledge of the difficulties involved in mobile forensics.

Mobile forensics tools and techniques for digital crime investigation: a comprehensive review

<p>Extracting and analyzing data from smartphones, IoT devices, and drones is crucial for conducting digital crime investigations. Effective cyberattack mitigation necessitates the use of advanced Android mobile forensics techniques. The investigation necessitates proficiency in manual, logical, hex dump, chip-off, and microread methodologies. This paper provides a comprehensive overview of Android mobile forensics tools and techniques for digital crime investigation, as well as their use in gathering and analyzing evidence. Forensic software tools like Cellebrite UFED, Oxygen Forensic Detective, XRY by MSAB, Magnet AXIOM, SPF Pro by SalvationDATA, MOBILedit Forensic Express, and EnCase Forensic employ both physical and logical techniques to retrieve data from mobile devices. These advanced tools offer a structured approach to tackling digital crimes effectively. We compare dependability, speed, compatibility, data recovery accuracy, and reporting. Mobile-network forensics ensures data acquisition, decryption, and analysis success. Conclusions show that Android mobile forensics tools for digital crime investigations are diverse and have different capabilities. Mobile forensics software offers complete solutions, but new data storage and encryption methods require constant development. The continuous evolution of forensic software tools and a comprehensive tool classification system could further enhance digital crime investigation capabilities.</p>

Navigating the cyber forensics landscape a review of recent innovations

<p><span>The extensive relevance of digital forensics in today's data-driven environment has been emphasized in this article. The free software and the commercial software community are debatable, despite users and developers often differing views on important topics like software safety and usability. This article primarily uses pre-defined criteria and a platform-oriented approach to examine promising freeware (Magnet Forensics and Sleuth Kit) vs. profitable (ProDiscover and Oxygen Forensic Suite) mobile forensics tools. Under diverse settings, the tools' capacity to develop and analyze forensically sound digital forensic media sources is validated. After erasing data, each media type was tested again after formatting. The study concludes with a comparison matrix that may aid in determining the best-fit option for the investigation's requirements among the tools. The findings indicate the potential for freeware to supplant numerous proprietary applications, as users can opt for freeware instead of incurring costs associated with proprietary software. Furthermore, this perception can be put into practice.</span></p>

Mobile Forensic for Body Shaming Investigation Using Association of Chief Police Officers Framework

Body shaming is the act of making fun of or embarrassing someone because of their appearance, including the shape or form of their body. Body shaming can occur directly or indirectly. MOBILEdit Forensic Express and Forensic ToolKit (FTK) Imager are used to perform testing of evidence gathered through Chat, User ID, Data Deletion, and Groups based on digital data obtained on IMO Messenger tokens on Android smartphones. This study aimed to collect evidence of conversations in body shaming cases using the Association of Chiefs of Police (ACPO) framework with MOBILedit Forensic Express and FTK Imager as a tool for testing. Based on the research findings, MOBILedit Forensic Express got an extraction yield of 0.75%. In contrast, using the FTK Imager got an extraction yield of 0.25%. The ACPO framework can be used to investigate cases of body shaming using mobile forensics tools so that the extraction results can be found. The results of this study contributed to forensic mobile knowledge in cases of body shaming or cyberbullying ACPO framework as well as for the investigators.

Understanding indirect users' privacy concerns in mobile forensics — A mixed method conjoint approach

IntroductionThe advent of mobile forensics toolkits introduces a technological leverage that allows legal authorities to access information stored on mobile devices, thus shining a new light on law enforcement procedures. These pocket-sized devices, mobile phones, accumulate a plethora of user data, effectively becoming a beacon for individual identification. However, the prospect of exploring this data within a criminal inquiry raises palpable concerns about potential privacy encroachments. Consequently, there exists an urgent need to balance the instrumental value of these technologies with their potential to intrude upon privacy, ensuring a framework that remains legally and ethically sound.MethodsIn our study, we offer a contemplative view on the public reception of such measures, informed by interviews and a conjoint study conducted across two representative cohorts from Germany and Austria (n = 2040).ResultsOur analysis indicates a marked preference for the release of geo-spatial data over more personal content, such as photographs. Additionally, respondents showed a higher acceptance for automated analysis in comparison to human manual evaluation. The divergence between the two countries was negligible.DiscussionIn summary, despite the inherent concerns, the use of these mobile forensics tools demonstrated a high degree of public acceptance. The results highlight the significance of aligning legislation based on data types rather than analysis purposes, which can enhance the general public's comprehension of laws and potentially contribute to societal advancement. Furthermore, the research emphasizes the importance of ethical evaluations and transparent communication in the implementation of automated mobile forensics systems for civil security purposes, effectively addressing concerns regarding privacy infringement and data analysis.

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Optimization in Security of Digital Evidences by Integration of Evidence Integrity Assurance Mechanism (EIAM) Plug-in into the Software Framework of Mobile Forensic Tools with Balanced Use of Antivirus Softwares

In today's era, there exists variety of mobile forensic tools both proprietary as well as open source tools and this generation of mobile forensic tools is evolving at a faster pace with new features which mainly focuses on the deep penetration into the mobile handheld to optimize the mobile forensic process and mainly extraction and decoding of mobile artifacts. But a bit less attention is provided towards the integrity of the digital evidence obtained. There are many factors that can alter the data and the use of antivirus software is one of the prominent factors among them. The importance of antivirus software in the machine could not be denied and hence its systematic use if done, will not only save the digital evidence from the malwares but also saves it from the antivirus software itself. The proposed work describes how the EIAM (Evidence Integrity Assurance Mechanism) plug-in handles the antivirus software in a smart optimized way.

AutoPoD-Mobile—Semi-Automated Data Population Using Case-like Scenarios for Training and Validation in Mobile Forensics

The complexity and constant changes in mobile forensics require special training of investigators with datasets that are as realistic as possible. Even today, the generation of training data is almost exclusively done manually. This paper presents a novel open-source framework called AutoPoD-Mobile. The framework supports the creation of case-based scenarios. Even more, the semi-automated provision of datasets for mobile forensics is enabled. Thus, the behavior of suspects interacting with each other can be simulated. The result combines mobile device data from normal device usage and case-related information. This way helps validate mobile forensic tools, test new techniques, and create realistic training datasets in the mobile forensics domain. The results of a proof-of-concept trial in a realistic deployment environment will also be presented. The paper concludes with a discussion of the results and identifies options for future improvements.

Advanced forensic procedure for the authentication of audio recordings generated by Voice Memos application of iOS14.

In this study, we propose an advanced forensic examination procedure for audio recordings generated by the Voice Memos application with iPhone Operation System (iOS)14, to verify that these are the original recordings and have not been manipulated. The proposed examination procedure consists of an analysis of the characteristics of audio recordings and of the file system of the device storing the audio recordings. To analyze the characteristics of audio recordings, we compare the encoding parameters (bitrate, sampling rate, timestamps, etc.) and the file structure to determine whether audio recordings were manipulated. Next, in the device examination step, we analyze the media-log history and temporary files of the file system obtained by mobile forensic tools. For comparative analysis, a total of 100 audio recording samples were obtained through the Voice Memos application from five iPhone mobile handsets of different models with iOS14 installed using Advanced audio coding (AAC) or Apple lossless audio codec (ALAC). As a result of analyzing the encoding parameters between the original and manipulated audio recordings, as well as the temporary files contained in the device file system, the difference in the encoding parameters and the very unique trace of the original audio recordings in the temporary files were confirmed when manipulating the audio recordings. In particular, the primary advantage of our proposed method is its potential ability to recover original audio recordings that were subsequently manipulated via the temporary files examined in the device file system analysis.

Implementation of ACPO Framework for Digital Evidence Acquisition in Smartphones

A forensic investigator or analyst should implement an appropriate digital forensic framework to acquire valid digital evidence to be presented at court. Choosing an unsuitable digital forensic framework with the investigation process may lead to failure at acquiring or maintaining complete digital evidence. Missing a step or turning a certain step into another irrelevant step may lead to unclear results and invalid conclusions. Digital evidence extracted from risky electronic evidence cannot be accepted by the court. Accordingly, a forensic investigator or forensic analyst should refer to a structuralized standard structure to perform well.Several internal digital forensic frameworks are available, one of which is the Good Practice Guide for Computer-based Electronic Evidence [1], an English issuance by ACPO (Association of Chief Police Officers) in cooperation with 7Safe. The digital forensic framework is commonly called the digital forensic framework from ACPO or the ACPO Framework. This research brings into focus the analysis of the percentage of success rate for using the ACPO digital forensic framework or the ACPO Framework in comparison with another digital forensic framework, i.e., NIST Framework. This research is also aimed at examining the performance of a mobile forensic tool, i.e., Cellebrite’s UFED Touch2 in comparison with another mobile forensic tool for digital evidence acquisition in smartphones.The research objects were smartphones containing deleted WhatsApp messages. This research successfully implemented the ACPO Framework for digital evidence acquisition in smartphones using Cellebrite’s UFED Touch2 as the mobile forensic tool.

Essential Components of Software Framework for Mobile Forensic Tool to Extract and Decode the Mobile Artifacts

Essential Components of Software Framework for Mobile Forensic Tool to Extract and Decode the Mobile Artifacts

Comparative Study of Different Mobile Forensic Tools for Extracting Evidence from Android Devices

Comparative Study of Different Mobile Forensic Tools for Extracting Evidence from Android Devices

Qualitative Assessment of Digital Forensic Tools

Forensic science is a study of science to criminals and civil laws. Digital forensics is the part of forensic science relating to proof found in computers and advanced storage media. Forensic examiners gather, protect and break down logical confirmations over the span of examination. Digital information contains data as content, pictures, sound, video and so on. These days numerous cybercrime cases, for example, hacking, banking cheats, phishing, email spamming, etc., have developed which are connected with a computerized information. Since the digital investigation is turning into an expanding concern, numerous digital forensic tools have been created to manage the difficulties of exploring computerized wrongdoings. The motivation behind digital forensics strategies is to look, protect and extract data on advanced frameworks to discover potential confirmations to exhibit them in the courtroom. In this paper, we have discussed five kinds of forensics namely Network Forensics, Live Forensics, Cyber Forensics, Database Forensics, and Mobile Forensics. The paper depicts a list of digital forensic tools in detail and looks at them based on the characterized parameters to figure out which tool suits better for any investigation. The paper looks at network, database and mobile forensic tools and examines the silent features and uniqueness of each of the tools along with their functionalities.

A Review of Mobile Forensic Investigation Process Models

Mobile Forensics (MF) field uses prescribed scientific approaches with a focus on recovering Potential Digital Evidence (PDE) from mobile devices leveraging forensic techniques. Consequently, increased proliferation, mobile-based services, and the need for new requirements have led to the development of the MF field, which has in the recent past become an area of importance. In this article, the authors take a step to conduct a review on Mobile Forensics Investigation Process Models (MFIPMs) as a step towards uncovering the MF transitions as well as identifying open and future challenges. Based on the study conducted in this article, a review of the literature revealed that there are a few MFIPMs that are designed for solving certain mobile scenarios, with a variety of concepts, investigation processes, activities, and tasks. A total of 100 MFIPMs were reviewed, to present an inclusive and up-to-date background of MFIPMs. Also, this study proposes a Harmonized Mobile Forensic Investigation Process Model (HMFIPM) for the MF field to unify and structure whole redundant investigation processes of the MF field. The paper also goes the extra mile to discuss the state of the art of mobile forensic tools, open and future challenges from a generic standpoint. The results of this study find direct relevance to forensic practitioners and researchers who could leverage the comprehensiveness of the developed processes for investigation.

Data Acquisition From Mobile Phone using Mobiledit

Mobile forensic is a subsidiary of digital forensic that is flourishing constantly. As per current scenario, mobile phones not only mean traditional mobile phones that were developed and used in late 1990s but also include smart phones that offer an array of functionality. Mobile phones developed in 1990s also known as feature phones provided limited functionality such as calling and messaging as they were subjected to provide communication facility. But at present, mobile phones are used not only for communication but also for executing face to face interactions, shopping using various applications, trading and internet surfing, etc thus making mobile more feature-variant and making them smart. Since, mobile phone market is constantly rising because of increased and improved features; usage of mobile phones in criminal activities or illegal activities has also increased. The crime scene can be re-created by identifying the series of actions that has taken place when crime was committed by using compatible mobile forensic tools. Current attack could not be prevented, but the investigator can attain all crucial evidences present on the crime scene in order to reduce similar kind of attacks in future. The capturing and recording of crime scene, collecting and analyzing the evidence and finding the culprit and reason of committing crime is the art of mobile forensics. In this paper, we are going to discuss the implementation of proposed framework by using tool MOBILedit

Forensic analysis of Google Allo messenger on Android platform

PurposeThe purpose of this paper is to conduct a forensic analysis of Google Allo messenger on an Android-based mobile phone. The focus was on the analysis of the data stored by this application in the internal memory of the mobile device, with minimal use of third-party applications. The findings were compared with the already existing works on this topic. Android is the most popular operating system for mobile devices, and these devices often contain a massive amount of personal information about the user such as photos and contact details. Analysis of these applications is required in case of a forensic investigation and makes the process easier for forensic analysts.Design/methodology/approachLogical acquisition of the data stored by these applications was performed. A locked Android device was used for this purpose. Some scripts are presented to help in data acquisition using Android Debug Bridge (ADB). Manual forensic analysis of the device image was performed to see whether the activities carried out on these applications are stored in the internal memory of the device. A comparative analysis of an existing mobile forensic tool was also performed to show the effectiveness of the methodology adopted.FindingsForensic artifacts were recovered from Allo application. Multimedia content such as images were also retrieved from the internal memory.Research limitations/implicationsAs this study was conducted for forensic analysis, it assumed that the mobile device used already has USB debugging enabled on it, although this might not be the applicable in some of the cases. This work provides an optimal approach to acquiring artifacts with minimal use of third-party applications.Practical implicationsMost of the mobile devices contain messaging application such as Allo installed. A large amount of personal information can be obtained from the forensic analysis of these applications, which can be useful in any criminal investigation.Originality/valueThis is the first study which focuses on the Google Allo application. The proposed methodology was able to extract almost as much as the data obtained using earlier approaches, but with minimal third-party application usage.

A forensic examination of the technical and legal challenges surrounding the investigation of child abuse on live streaming platforms: A case study on Periscope

Video streaming provision are now widely used and whilst commercialised platforms face challenges with accessing and protecting copyrighted media, the emerging popularity of personalised live streaming services has resulted in a number of additional recorded abuses. In 2017, reports of personal live streaming platforms being used in acts of harassment, offences against the person and vehicle incidents have surfaced in the media. Of significant concern is the apparent use of streaming connected with acts of child abuse, where following the enactment of the Policing and Crime Act 2017, acknowledgement for the use of streaming for child sexual exploitation has been made in England and Wales. Whilst a positive step towards closing an apparent gap in legislation caused by this technology, practical enforcement of the offence may be difficult. This article investigates the challenges posed by the live streaming platform ‘Periscope’, offering an examination methodology for this application to support those investigating cases of abuse via Periscope. The results of a digital forensic analysis of Periscope's usage both in a web browser, Android and Apple mobile device platform presented. Periscope's footprint on Android and iOS is documented with key artefacts denoting a user's behaviour via the application are examined in order to support practitioners configure existing mobile forensic tools to extract and interpret resident Periscope application data, with analysis limitations noted. Findings are provided and discussed inline with their impact upon regulatory practices and live streaming investigations.

An Evidence-based Forensic Taxonomy of Windows Phone Dating Apps.

Advances in technologies including development of smartphone features have contributed to the growth of mobile applications, including dating apps. However, online dating services can be misused. To support law enforcement investigations, a forensic taxonomy that provides a systematic classification of forensic artifacts from Windows Phone 8 (WP8) dating apps is presented in this study. The taxonomy has three categories, namely: Apps Categories, Artifacts Categories, and Data Partition Categories. This taxonomy is built based on the findings from a case study of 28 mobile dating apps, using mobile forensic tools. The dating app taxonomy can be used to inform future studies of dating and related apps, such as those from Android and iOS platforms.

A forensic evidence recovery from mobile device applications

In recent past, there are a lot of research advancements in mobile forensics tools. This is so due to increase usage of mobile phones in storage of information, law enforcement, mobile online trans...

A framework and a process for digital forensic analysis on smart phones with multiple data logs

Nowadays mobile devices are considered an essential component of our daily lives. The rapid evolution in mobile computing has becomes a frustrating factor for law enforcement and the forensic community at large, because of the lack of industry standard, tools and training. Smartphones are becoming the most difficult to extract evidentiary data from. While many commercial forensic tools have made great strides in supporting data extraction, decoding, and analysis, some challenges remain. The smart phones not only keep us connected but also can act as a mobile office, a social tool, and an entertainment centre. The combination of functionality, processing power, and storage space makes smartphones a prime target for investigators. To our knowledge, there is no mobile forensic analysis solution that maps data from different sources including calls, geographical location, multimedia, and web logs. Based on this motivation, in this paper, we aim to propose a framework solution, which could contribute to the development of a novel and potentially a market leading mobile forensic tool.