Mobile Forensic Tools Research Articles

A framework and a process for digital forensic analysis on smart phones with multiple data logs

Nowadays mobile devices are considered an essential component of our daily lives. The rapid evolution in mobile computing has becomes a frustrating factor for law enforcement and the forensic community at large, because of the lack of industry standard, tools and training. Smartphones are becoming the most difficult to extract evidentiary data from. While many commercial forensic tools have made great strides in supporting data extraction, decoding, and analysis, some challenges remain. The smart phones not only keep us connected but also can act as a mobile office, a social tool, and an entertainment centre. The combination of functionality, processing power, and storage space makes smartphones a prime target for investigators. To our knowledge, there is no mobile forensic analysis solution that maps data from different sources including calls, geographical location, multimedia, and web logs. Based on this motivation, in this paper, we aim to propose a framework solution, which could contribute to the development of a novel and potentially a market leading mobile forensic tool.

Pokémon GO Forensics: An Android Application Analysis

As the geolocation capabilities of smartphones continue to improve, developers have continued to create more innovative applications that rely on this location information for their primary function. This can be seen with Niantic’s release of Pokémon GO, which is a massively multiplayer online role playing and augmented reality game. This game became immensely popular within just a few days of its release. However, it also had the propensity to be a distraction to drivers, resulting in numerous accidents, and was used as a tool by armed robbers to lure unsuspecting users into secluded areas. This facilitates the need for forensic investigators to be able to analyze the data within the application in order to determine if it may have been involved in these incidents. Because this application is new, limited research has been conducted regarding the artifacts that can be recovered from the application. In this paper, we aim to fill the gaps within the current research by assessing what forensically-relevant information may be recovered from the application and understanding the circumstances behind the creation of this information. Our research focuses primarily on the artifacts generated by the Upsight analytics platform, those contained within the bundles directory and the Pokémon Go Plus accessory. Moreover, we present our new application-specific analysis tool that is capable of extracting forensic artifacts from a backup of the Android application and presenting them to an investigator in an easily-readable format. This analysis tool exceeds the capabilities of the well known mobile forensic tool Cellebrite’s UFED (Universal Forensic Extraction Device) Physical Analyzer in processing Pokémon GO application data.

Special issue on Big Data Security and Intelligent Data in Clouds (BDS‐IDC)

Special issue on Big Data Security and Intelligent Data in Clouds (<scp>BDS‐IDC</scp>)

Comparative Studies on Mobile Forensic Evidence Extraction Open Source Software for Android Phone

The Android Forensic software grows in numbers, and increased awareness of the data they process have also grown day to day basis, but much of the interest from cybercriminal to successfully attack the device and also the careless of the human being itself have placed the android phone content at the risk. Forensic examiner have always gone for an expensive forensic toolkit to meet the industry standards, but normal people have been always tent to lose the direction when they experience this type of attack or the data lost as it may cost a few thousand to fix it back. Therefore, the purpose of this paper is suggesting a reliable open source mobile forensic tool based on experiments conducted to retrieve deleted data and also extract other important content from android mobile phone.

A Forensic Mobile Application Designed for both Steganalysis and Steganography in Digital Images

With the rapid development of mobile devices and multimedia processing technologies, digital multimedia applications has become increasingly more popular in our daily life. Due to the nature of digital media, digital images can be easily modified without leaving obvious traces. Digital image forensics is an emerging research field which aims to address the major problems as forgery detection, source identification, image recovery and detecting the existence of hidden information, which is also referred as steganalysis. Steganography is the science of covert communication which aims to conceal the existence of the secret information hidden in the communication. Steganalysis is the study of detecting hidden information, which is embedded by using steganography techniques. In this paper we present a forensic mobile application developed on iOS platform. This application is designed to perform both steganalysis and steganorgraphy tasks in digital images; that is to conduct information analysis of given images and determine if there is any secret information hidden in the given images, and also fulfill the task of hiding information invisibly into digital images. There have been a number of well-established techniques in digital image steganalysis and steganography fields during recent years. However, there are very few mobile forensic tools that have been developed to comprehensively adopt these methods. Our forensic mobile application aims to systematically include significant methods both in steganography and steganalysis fields, so that people can use it as a forensic tool to determine if an image contains a hidden message, as well as use it as a security tool to perform covert communication by hiding information in an image.

An Android Communication App Forensic Taxonomy.

Due to the popularity of Android devices and applications (apps), Android forensics is one of the most studied topics within mobile forensics. Communication apps, such as instant messaging and Voice over IP (VoIP), are one popular app category used by mobile device users, including criminals. Therefore, a taxonomy outlining artifacts of forensic interest involving the use of Android communication apps will facilitate the timely collection and analysis of evidentiary materials from such apps. In this paper, 30 popular Android communication apps were examined, where a logical extraction of the Android phone images was collected using XRY, a widely used mobile forensic tool. Various information of forensic interest, such as contact lists and chronology of messages, was recovered. Based on the findings, a two-dimensional taxonomy of the forensic artifacts of the communication apps is proposed, with the app categories in one dimension and the classes of artifacts in the other dimension. Finally, the artifacts identified in the study of the 30 communication apps are summarized using the taxonomy. It is expected that the proposed taxonomy and the forensic findings in this paper will assist forensic investigations involving Android communication apps.

Forensic taxonomy of android productivity apps

Android productivity apps have provided the facility of having a constantly accessible and productive workforce to the information and work capabilities needed by the users. With hundreds of productivity apps available in the Android app market, it is necessary to develop a taxonomy for the forensic investigators and the end users to allow them to know what personal data remnants are available from the productivity apps. In this paper, 30 popular Android productivity apps were examined. A logical extraction of the Android phone was collected by using a well-known mobile forensic tool- XRY to extract various information of forensic interest such as user email ID and list of tasks. Based on the findings, a two-dimensional taxonomy of the forensic artefacts of the productivity apps is proposed with the app categories in one dimension and the classes of artefacts in the other dimension. The artefacts identified in the study of the apps are summarised using the taxonomy. In addition, a comparison with the existing forensic taxonomies of different categories of Android apps is provided to facilitate timely collection and analysis of evidentiary materials from mobile devices.

Forensic data acquisition from cloud‐of‐things devices: windows Smartphones as a case study

SummaryThe continued amalgamation of cloud technologies into all aspects of our daily lives and the technologies we use (i.e. cloud‐of‐things) creates business opportunities, security and privacy risks, and investigative challenges (in the event of a cybersecurity incident). This study examines the extent to which data acquisition from Windows phone, a common cloud‐of‐thing device, is supported by three popular mobile forensics tools. The effect of device settings modification (i.e. enabling screen lock and device reset operations) and alternative acquisition processes (i.e. individual and combined acquisition) on the extraction results are also examined. Our results show that current mobile forensic tool support for Windows Phone 8 remains limited. The results also showed that logical acquisition support was more complete in comparison to physical acquisition support. In one example, the tool was able to complete a physical acquisition of a Nokia Lumia 625, but its deleted contacts and SMSs could not be recovered/extracted. In addition we found that separate acquisition is needed for device removable media to maximize acquisition results, particularly when trying to recover deleted data. Furthermore, enabling flight‐mode and disabling location services are highly recommended to eliminate the potential for data alteration during the acquisition process. These results should provide practitioners with an overview of the current capability of mobile forensic tools and the challenges in successfully extracting evidence from the Windows phone platform. Copyright © 2016 John Wiley &amp; Sons, Ltd.

모바일 포렌식 증거능력 확보 방안 연구

Because of the evolution of mobile devices such as smartphone, the necessity of mobile forensics is increasing. In spite of this necessity, the mobile forensics does not fully reflect the characteristic of the mobile device. For this reason, this paper analyzes the legal, institutional, and technical considerations for figuring out facing problems of mobile forensics. Trough this analysis, this study discuss the limits of screening seizure on the mobile device. Also, analyzes and verify the mobile forensic data acquisition methods and tools for ensuring the admissibility of mobile forensic evidence in digital investigation.

Framework for Mobile Devices Analysis

Nowadays mobile devices are considered an essential component of our daily lives. The smart phones not only keep us connected but also can act as a mobile office, social tool, and an entertainment center. The combination of functionality, processing power, and storage space makes smartphones a prime target for investigators. The rapid evolution in mobile computing is forcing towards the need for standards and tools to investigate and analyze these mobile devices and extract useful information that help in more protection against cyber threats and improving performance in many aspects including power consumption. Up to our knowledge, there is no mobile forensic analysis solution that maps data from different sources including calls, geographical location, multimedia, and web logs. Based on this motivation, in this paper, we aim to propose a framework solution, which could contribute to the development of a novel and potentially a market leading mobile forensic tool.

Mobile Forensic Images and Videos Signature Pattern Matching using M-Aho-Corasick

Mobile forensics is an exciting new field of research. An increasing number of Open source and commercial digital forensics tools are focusing on less time during digital forensic examination. There is a major issue affecting some mobile forensic tools that allow the tools to spend much time during the forensic examination. It is caused by implementation of poor file searching algorithms by some forensic tool developers. This research is focusing on reducing the time taken to search for a file by proposing a novel, multi-pattern signature matching algorithm called M-Aho-Corasick which is adapted from the original Aho-Corasick algorithm. Experiments are conducted on five different datasets which one of the data sets is obtained from Digital Forensic Research Workshop (DFRWS 2010). Comparisons are made between M-Aho-Corasick using M_Triage with Dec0de, Lifter, XRY, and Xaver. The result shows that M-Aho-Corasick using M_Triage has reduced the searching time by 75% as compared to Dec0de, 36% as compared to Lifter, 28% as compared to XRY, and 71% as compared to Xaver. Thus, M-Aho-Corasick using M_Triage tool is more efficient than Dec0de, Lifter, XRY, and Xaver in avoiding the extraction of high number of false positive results.

Payment card forensic analysis: From concepts to desktop and mobile analysis tools

While one would not even consider them alike, payment cards are one of the most valuable and widely used embedded systems. Payment card systems are probably the most attacked and counterfeited. In fact, even though the use of smart cards have introduced high security capabilities, criminal activity has not been deterred and payment card fraud remains a lucrative activity.From low-tech (carding) to high-tech (man in the middle attack) fraud, all payment card based frauds require stealing or modifying card data and reusing it with a direct profit. Physical forms of fraud, such as Automated Teller Machine (ATM) withdrawals or in store payments, are mostly based on and associated with manipulated cards. Through their nefarious actions, that may include overwriting the magnetic strip data or injecting attacks on the embedded microcontroller, criminals are able to realise significant monetary gains.To effectively deal with these fraud cases, investigators have to quickly determine whether a card is authentic or a counterfeit. Currently no known easy forensic tool exists that provides a quick effective and accurate response.In this article, after having conceptualised payment cards as multi-interface embedded systems, we propose simple and fast forensic analysis methods to finally provide investigators with associated desktop and mobile forensic tools.

Performance Measurement for Mobile Forensic Data Acquisition in Firefox OS

Mozilla Corporation has recently released a Linux-based open source operating system, namely Firefox OS. The arrival of this Firefox OS has created new challenges, concentrations and opportunities for digital investigators. Currently, Firefox OS is still not fully supported by most of the existing mobile forensic tools. Even when the phone is detected as Android, only pictures from removable memory was able to be captured. Furthermore, the internal data acquisition is still not working. Therefore, there are very huge opportunities to explore the Firefox OS on every stages of mobile forensic procedures. This paper will present an approach for mobile forensic data acquisition in a forensically sound manner from a Firefox OS running device. This approach will largely use the UNIX dd command to create a forensic image from the Firefox OS running device. Apart from that, performance measurement will be made to find the best block size for acquisition process in Firefox OS.

Forensic acquisition and analysis of palm webOS on mobile devices

The emergence of webOS on Palm devices has created new challenges and opportunities for digital investigators. With the purchase of Palm by Hewlett Packard, there are plans to use webOS on an increasing number and variety of computer systems. These devices can store substantial amounts of information relevant to an investigation, including digital photographs, videos, call logs, SMS/MMS messages, e-mail, remnants of Web browsing and much more. Although some files can be obtained from such devices with relative ease, the majority of information of forensic interest is stored in databases on a system partition that many mobile forensic tools do not acquire. This paper provides a methodology for acquiring and examining forensic duplicates of user and system partitions from a device running webOS. The primary sources of digital evidence on these devices are covered with illustrative examples. In addition, the recovery of deleted items from various areas on webOS devices is discussed.

Mobile phone forensics: an overview of technical and legal aspects

Over the last 20 years, the number of mobile phone users in the world has grown from a mere handful to more than 3 billion. It is estimated that more than 1,000 new customers sign up for mobile services every minute around the world. Consequently, the use of mobile phones connected to criminal activity is on increase. The forensic examination of mobile phones is complicated by the fact that each new model requires different analysis tools and investigative techniques. The developers of mobile phone forensic tools struggle to keep pace with changing technologies and capabilities of modern day devices. This paper outlines legal and technical challenges and illustrates the relevance of UK ACPO guidelines to carrying out proper examinations/investigations. It then discusses different models and practices developed or adopted by investigators worldwide. It also examines, with reference to various laws, the legal position of an investigator when examining a mobile phone.

An overall assessment of Mobile Internal Acquisition Tool

The smartphone market provides a great variety of manufacturers and models causing a strong (and mandatory) heterogeneity of the hardware tools adopted to retrieve smartphone contents in a forensically sound way. Thus, in order to lighten the burden for already overtaxed police operators, with possible increase of forensics productivity, we already identified, in a previous work, a new Mobile Equipment (ME) acquisition paradigm. In fact, it's possible to avoid the practical problems related to the USB/mobile phone plug heterogeneity, currently used by the mobile forensics tools, through the use of the MMC/SD slot, part of the hardware equipment of the target ME. This solution overcomes the problems related to the acquisition through the cables, simply relying on a piece of software installed stored into the SD/MMC. The contribution of this paper enriches the methodology already presented by the authors and presents some fundamental properties of the Mobile Internal Acquisition Tool (MIAT) in order to assess the performance with respect to the state of the art of the mobile forensics tools. The results of the assessment encourage the adoption of this tool, since integrity, performances and operational methodology mostly overall benefit from this approach, while, in the worst case, remain at the same level of the state of the art COTS. Finally, this tool, intended to be released under an Open Source license, proposes the paradigm where the acquisition source code is in the public domain, while the analysis and presentation are left to self-made/proprietary tools.

Data recovery from PalmmsgV001

Both SMS and MMS data analysis is an important factor in mobile forensic analysis. Author did not find any mobile forensic tool that is capable of extracting short messages (SMS) and multimedia messages (MMS) from Palm Treo 750. SMS file of Palm Treo 750 is called PalmMgeV001 and it is a proprietary file system. A research work done to find a method to recover SMS data from PalmMsgV001 file. This paper is going to describe the research work and its findings. This paper also discusses a methodology that will help recover SMS data from PalmMsgV001. The PalmMsgV001 file is analysed using hex analysis method. Solutions were found to recover each message from every folder like Inbox, Outbox, Sentbox, Draft and Template. The research work partially contributes to improving mobile forensic analysis since the finding will be helpful to forensic tool developers. At this stage, this study will concern only the SMS part and not the MMS part.