Mobile Forensics Research Articles

Analysis and Comparison of Social Media Applications Using Forensic Software on Mobile Devices

With the integration of mobile systems into daily life, social media applications used especially on Android and iOS platforms contain a significant amount of sensitive information. Social media applications on mobile systems have huge personal and sensitive content. Therefore, it is important to design effective techniques for forensic analysis of social media applications and to detect personal data. In this research, three different paid mobile forensic software and 4 different brands and models of smartphones with different operating systems were used and analyzed. The study shows that private messages, e-mails, time information, shared data, location and time information, and other personal data can be obtained by a forensic expert who performs an examination, and it is seen that one software can access the deleted data, but another software cannot access it. In proportion to the technology used in today’s world, mobile forensics incidents are increasing day by day, and a competitive environment is created among the software used to illuminate these incidents. With this competition, software companies dealing with forensic informatics are trying to obtain different data to illuminate forensic events that may occur due to the active use of social media accounts with the developing technology, and software that does not meet the needs in the face of this situation remains in the background. The criminal elements in the investigation areas of mobile forensics differ daily, and the scope of crimes in the virtual environment is expanding with the developing technology. Therefore, mobile forensic analysis applications should be successful in social media applications other than standard data.

A Survey on Mobile Digital Forensic: Taxonomy, Tools, and Challenges

ABSTRACTModern time largely rely on mobile gadgets as a means of communication, and entertainment. These gadgets now plays a vital role in forensic analysis and criminal investigations as it store a plethora of private and sensitive data. Investigating feasible digital incidents and preserving mobile device security became crucial as the proliferation of mobile devices continues to influence modern society. In this survey; mobile threats, investigative process models for mobile forensics, evidence sources, forensics tools, and field problems are all covered in‐depth. Further, a comprehensive analysis examining the capabilities, features, and efficiency of available distinct mobile forensic tools namely Belkasoft, MOBILedit, and Magnet AXIOM for retrieving, analyzing, and presenting digital evidence is being presented. The objective of the study is to assist forensic investigators in choosing the best tool for specific investigations. The findings of our study reveals the complexity of mobile operating systems, investigative process supported with sources of evidence, and forensic tools which makes it clear that the area of mobile forensics is dynamic and require modern skill adaptation along and innovative development in future. Finally, the study presents current challenges encountered during mobile forensic investigations as researchers can enhance their procedures and tactics for mobile device examination and evidence extraction by fostering a greater knowledge of the difficulties involved in mobile forensics.

Development of Digital Forensic Framework for Anti-Forensic and Profiling Using Open Source Intelligence in Cyber Crime Investigation

Abstract. Cybercrime is a crime that increases every year. The development of cyber crime occurs by utilizing mobile devices such as smartphones. So it is necessary to have a scientific discipline that studies and handles cybercrime activities. Digital forensics is one of the disciplines that can be utilized in dealing with cyber crimes. One branch of digital forensic science is mobile forensics which studies forensic processes on mobile devices. However, in its development, cybercriminals also apply various techniques used to thwart the forensic investigation process. The technique used is called anti-forensics. Purpose: It is necessary to have a process or framework that can be used as a reference in handling cybercrime cases in the forensic process. This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. Methods/Study design/approach: This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. By testing the scenario data, the results are obtained in the form of processing additional information from the files obtained and information related to user names. Result/Findings: The result is a digital forensic phase which concern on anti-forensic identification on media files and utilizing OSINT to perform crime suspect profiling based on the evidence collected in digital forensic investigation phase. Novelty/Originality/Value: Found 3 new types of findings in the form of string data, one of which is a link, and 7 new types in the form of usernames which were not found in the use of digital forensic tools. From a total of 408 initial data and new findings with a total of 10 findings, the percentage of findings increased by 2.45%.

Data Synthesis Is Going Mobile—On Community-Driven Dataset Generation for Android Devices

Personal electronic devices such as smartphones and smartwatches have become indispensable daily companions, collecting a multitude of personal and sensitive data. As a result, they are of paramount importance in digital forensic examinations. However, there is a lack of publicly available and ready-to-use digital forensic datasets, especially in mobile forensics. This work presents a concept and an open-source proof-of-concept implementation, which simplifies and automates the creation of mobile forensic datasets within the scope of the Android operating system. In contrast to previous approaches, which populate the most common databases of an Android device, our concept is based on community-driven playbooks and makes use of interaction with the actual smartphone GUI. Hence, we are able to generate coherent and realistic traces as they occur in real-world human usage. Our proof-of-concept implementation is based on the standard Android emulation environment and borrows tools from the user interface testing community. Our evaluation shows that our approach actually generates realistic Android datasets. For instance, we can generate traces that cannot be simulated by gestures (e.g., changing the GPS position or triggering incoming phone calls). Recording the actual data synthesis process allows users to either create and share their own playbooks (i.e., the exact instructions for the data synthesis process rather than having to share the full image) or reproduce Android images with different scenarios using playbooks previously created and shared by the community.

Forensic Analysis of the WhatsApp Application Using the National Institute of Justice Framework

The advancement of communication media has rapidly evolved with the emergence of various communication applications on smartphones, which have now surpassed mere communication functions to become complex social media platforms. This change has transformed the way we interact, not only through messages and voice but also through the exchange of videos and images. However, along with these developments, there has been a surge in digital crimes such as defamation, fraud, and drug trafficking. This investigation aims to compare the performance of forensic tools in obtaining digital evidence by utilizing applications like Mobiledit, Belkasoft, Mobile Forensic SPF, and Magnet Axiom, and by applying the National Institute of Justice framework, which consists of five stages: identification, collection, examination, analysis, and reporting. The output of the investigation is presented through reports and evidence, resulting in text chat files, contacts, images, audio, and view-once images. Forensic tools have a 100% success rate in finding pieces of evidence. The comparison of the four tools showed different percentages: Mobiledit Forensic 40%, Magnet Axiom 80%, Belkasoft 60%, and Mobile Forensic SPF 60% in obtaining evidence. Digital evidence can be used as strong support in court proceedings.

Logical methods of forensic expertise of Android devices

Mobile devices are now so ubiquitous that they have revolutionized the way we do most of our activities. As a result, the mobile device is now a huge repository of confidential and personal information about its owner. This has led to the development of mobile forensics, which focuses on the recovery and investigation of mobile data. The purpose of the diagnostic process is to retrieve and recover any information from a mobile device without changing the data on the device. Over the years, digital forensics has expanded with the rapid growth of mobile devices. There are different branches of digital forensics depending on the type of digital device, such as computer forensics, network forensics, mobile forensics, etc. Data obtained from telephones becomes an invaluable source of evidence for investigations in criminal and civil cases. It's rare to conduct digital forensics without using a phone. Third-party applications are an integral part of the investigation mobile device. This requires understanding where app data is stored on the device, what app data is stored for that platform, and which tool best helps uncover the evidence. Although some commercial tools, such as Magnet IEF, are known for supporting application parsing, no tool is perfect, and it is nearly impossible for tools to keep up with the frequent updates that are released for each application. The most commonly available commercial tools analyze the most popular programs on the market. For example, when Facebook acquired WhatsApp, Cellebrite, IEF, and Oxygen Forensics started supporting the app. This is where all programs differ.

Mobile forensics tools and techniques for digital crime investigation: a comprehensive review

<p>Extracting and analyzing data from smartphones, IoT devices, and drones is crucial for conducting digital crime investigations. Effective cyberattack mitigation necessitates the use of advanced Android mobile forensics techniques. The investigation necessitates proficiency in manual, logical, hex dump, chip-off, and microread methodologies. This paper provides a comprehensive overview of Android mobile forensics tools and techniques for digital crime investigation, as well as their use in gathering and analyzing evidence. Forensic software tools like Cellebrite UFED, Oxygen Forensic Detective, XRY by MSAB, Magnet AXIOM, SPF Pro by SalvationDATA, MOBILedit Forensic Express, and EnCase Forensic employ both physical and logical techniques to retrieve data from mobile devices. These advanced tools offer a structured approach to tackling digital crimes effectively. We compare dependability, speed, compatibility, data recovery accuracy, and reporting. Mobile-network forensics ensures data acquisition, decryption, and analysis success. Conclusions show that Android mobile forensics tools for digital crime investigations are diverse and have different capabilities. Mobile forensics software offers complete solutions, but new data storage and encryption methods require constant development. The continuous evolution of forensic software tools and a comprehensive tool classification system could further enhance digital crime investigation capabilities.</p>

Mobile Device Forensics Framework: A Toolbox to Support and Enhance This Process

Cybercrime is growing rapidly, and it is increasingly important to use advanced tools to combat it and support investigations. One of the battlefronts is the forensic investigation of mobile devices to analyze their misuse and recover information. Mobile devices present numerous challenges, including a rapidly changing environment, increasing diversity, and integration with the cloud/IoT. Therefore, it is essential to have a secure and reliable toolbox that allows an investigator to thwart, discover, and solve all problems related to mobile forensics while deciphering investigations, whether criminal, civil, corporate, or other. In this work, we propose an original and innovative instantiation of a structure in a forensic toolbox for mobile devices, corresponding to a set of different applications, methods, and best practice information aimed at improving and perfecting the investigative process of a digital investigator. To ensure scientific support for the construction of the toolbox, the Design Science Research (DSR) methodology was applied, which seeks to create new and unique artifacts, drawing on the strength and knowledge of science and context. The toolbox will help the forensic investigator overcome some of the challenges related to mobile devices, namely the lack of guidance, documentation, knowledge, and the ability to keep up with the fast-paced environment that characterizes the mobile industry and market. Doi: 10.28991/ESJ-2024-08-03-011 Full Text: PDF

Integrating Blockchain and Deep Learning for Enhanced Mobile VPN Forensics: A Comprehensive Framework

In an era marked by technological advancement, the rising reliance on Virtual Private Networks (VPNs) necessitates sophisticated forensic analysis techniques to investigate VPN traffic, especially in mobile environments. This research introduces an innovative approach utilizing Convolutional Neural Networks (CNNs) and Graph Neural Networks (GNNs) for classifying VPN traffic, aiding forensic investigators in precisely identifying applications or websites accessed via VPN connections. By leveraging the combined strengths of CNNs and GNNs, our method provides an effective solution for discerning user activities during VPN sessions. Further extending this framework, we incorporate blockchain technology to meticulously record all mobile VPN transactions, ensuring a tamper-proof and transparent ledger that significantly bolsters the integrity and admissibility of forensic evidence in legal scenarios. A specific use-case demonstrates this methodology in mobile forensics, where our integrated approach not only accurately classifies data traffic but also securely logs transactional details on the blockchain, offering an unprecedented level of detail and reliability in forensic investigations. Extensive real-world VPN dataset experiments validate our approach, highlighting its potential to achieve high accuracy and offering invaluable insights for both technological and legal domains in the context of mobile VPN usage.

CyberFusion Protocols: Strategic Integration of Enterprise Risk Management, ISO 27001, and Mobile Forensics for Advanced Digital Security in the Modern Business Ecosystem

This research paper explores the integration of Enterprise Risk Management (ERM), the ISO 27001 standard, and mobile forensics methodologies as a comprehensive framework for enhancing digital security measures within modern business ecosystems. Employing a quantitative research design, this paper utilized a survey methodology, gathering data from 372 professionals across various sectors including risk management, IT/security, and forensic analysis. The analysis was conducted using Partial Least Squares Structural Equation Modeling (PLS-SEM) to test the research hypotheses and assess the impact of the integrated approach on organizational digital security capabilities. The findings reveal a significant positive effect of integrating ERM, ISO 27001, and mobile forensics on an organization’s ability to manage digital risks effectively. Specifically, the integrated approach was found to enhance strategic digital security management, improve the identification, assessment, and mitigation of digital risks, strengthen information security management practices, and elevate the effectiveness and efficiency of digital crime investigation processes. These outcomes underscore the value of a cohesive strategy that leverages the strengths of ERM, ISO 27001, and mobile forensics in addressing the complex and interconnected digital threat landscape. Based on the results, the study recommends adopting a holistic security framework, investing in continuous professional development, leveraging technological advancements for proactive security management, and fostering a culture of security and collaboration. Such measures are crucial for organizations aiming to enhance their resilience against cyber threats and protect their digital assets in the face of sophisticated cyber-attacks. This research contributes to the field of cybersecurity by providing empirical evidence on the benefits of an integrated approach to digital security, offering practical guidelines for organizations seeking to improve their digital security measures, and highlighting the need for continuous adaptation and collaboration in the fight against cyber threats.

Mobile Forensics in Financial Fraud Analysis

Mobile forensics, a critical component of digital forensics, is essential for investigating and analyzing digital evidence pertinent to financial fraud security. This guide delineates key steps and methodologies, with a focus on device identification, secure data extraction, password decryption, cloud and deleted data analysis, timeline reconstruction, network and geolocation analysis, app and social media investigations, and comprehensive reporting. The operational process involves acquiring mobile devices, analyzing file systems for financial data, extracting and decoding relevant information, verifying findings, collaborating with network forensics for broader insights, and presenting conclusive results. Mobile forensics plays a pivotal role in uncovering evidence for financial crimes, ranging from fraudulent transactions to data breaches, where mobile devices serve as critical tools. Specialized techniques in mobile forensics contribute significantly to meticulous and successful investigations aimed at mitigating financial fraud risks. Keywords- Mobile Forensics, Data, Analysis, Extraction, Evidence, Financial fraud

Navigating the cyber forensics landscape a review of recent innovations

<p><span>The extensive relevance of digital forensics in today's data-driven environment has been emphasized in this article. The free software and the commercial software community are debatable, despite users and developers often differing views on important topics like software safety and usability. This article primarily uses pre-defined criteria and a platform-oriented approach to examine promising freeware (Magnet Forensics and Sleuth Kit) vs. profitable (ProDiscover and Oxygen Forensic Suite) mobile forensics tools. Under diverse settings, the tools' capacity to develop and analyze forensically sound digital forensic media sources is validated. After erasing data, each media type was tested again after formatting. The study concludes with a comparison matrix that may aid in determining the best-fit option for the investigation's requirements among the tools. The findings indicate the potential for freeware to supplant numerous proprietary applications, as users can opt for freeware instead of incurring costs associated with proprietary software. Furthermore, this perception can be put into practice.</span></p>

Artificial intelligence in mobile forensics: A survey of current status, a use case analysis and AI alignment objectives

As the capabilities and utility of Artificial Intelligence and Machine Learning systems continue to improve, they are expected to have an increasingly powerful influence in the digital forensic investigation process. The concurrent proliferation of mobile devices and rapid increase of forensic value of related artifacts creates the requirement for a comprehensive review of the current status of artificial intelligence software usage and usefulness in Mobile Forensics. In this context, we conducted a survey to evaluate the characteristics and properties of AI functions in mobile forensic software from the practitioners' perspective and enhance understanding to the work in the field. In this study, we evaluated the performance of image categorization software in digital forensics using a variety of evaluation metrics including accuracy, precision, recall, and F1-score, as well as the confusion matrix. In this research we also identify and integrate theoretical principles to conceptualize an AI Alignment framework pertaining to Mobile Forensics and Digital Forensics in general, in order to accurately determine specific AI strategy objectives and potential solutions to the current technical and administrative landscape. We emphasized the importance of interpretability and transparency in AI systems and the need for a comprehensive approach to understanding the reasoning behind the software's decisions. Additionally, we highlighted the importance of robustness in image categorization software, as well as the consideration of AI governance and standardized procedures concepts. Our results show that the accuracy and robustness of the image categorization software have a significant impact on the outcome of legal cases and that the software should be designed with interpretability, transparency, and robustness in mind. Through the examination of the survey responses, the evaluation of the image categorization software and research literature, we explore existing and potential approaches to aligned Artificial Intelligence and analyze their contribution to the forensic examination of cases.

Using Digital Forensics for Android Smartphone Devices to aid Criminal Investigations

In the past decade, there has been an exponential adoption and ownership of smartphones by billions of users worldwide. However, as smartphone usage increases, criminals have taken advantage of them for illicit or criminal purposes. In criminal investigations, smartphone data has become an invaluable source of information. This study focuses on constructing a snapshot of Android-operated smartphone data to assist investigators in answering critical investigative questions. A thorough review of the literature with regard to the use of smartphone evidence in criminal cases, with the goal of emphasising the investigative phase and the supportive role of mobile data evidence in guiding investigations will be performed. In order to identify additional persons of interest and develop a thorough understanding of the case, the methodology will entail analysing user profiles, smartphone usage patterns, communication logs, application usage, geographic lookups, and device interactions. By conducting a thorough examination of relevant literature, designing a suitable model, and executing a case study, the study intends to offer valuable perspectives on the creation of timelines or visual representations derived from smartphone data. The results of this study will contribute to improving the efficacy of mobile forensics in assisting investigators and facilitating the use of Android-operated smartphone data as supporting evidence in criminal investigations.

A Framework for Mobile Forensic Readiness in Yemen

One of the most important inventions of the 20th century is the mobile phone. In addition to making and receiving phone calls, a mobile phone can be used for texting, gaming, taking photos, recording movies, and accessing the internet, among many other things. This paper develops a framework for mobile forensic readiness in Yemen. In addition, mobile forensic readiness (MFR) aims to know the level of readiness for mobile forensic in Yemen, the level of mobile forensic factors in Yemen, and factors that affect the readiness for mobile forensic in Yemen. The main goal of forensic preparedness is to maximize an organization's capacity for establishing the viability of conducting forensic investigations and for accessing digital evidence at the lowest possible cost of an inquiry. Fundamentally, the primary goal of forensic preparation is to guarantee that the evidence is pertinent and comprehensive enough for the forensic investigation. The research is descriptive and collects indicators of MFR from literature review and 110 questionnaire that given to the Yemeni criminal investigation bureau employees, technology users, public prosecutor office employees. Furthermore, through the interviews were done with the police station managers and their employees. However, the returned questionnaires were 101. Statistical Package for the Social Sciences (SPSS) was used to analyze and test the data through mean, standard deviation, and one sample T- test. Moreover, SPSS AMOS was used to design the framework. All mentioned hypotheses were tested using regression, T- Value, Beta, P- value, and R-square. Therefore, the results show that all hypotheses were supported. This paper develops a framework for mobile forensic which reveals if we have a suitable infrastructure for mobile forensic and increase the awareness of mobile forensic which assists the experts to recover and analyze data. Furthermore, this research increases the potential use of digital evidence and increases the trust in the mobile forensic process.

A Systematic Literature Review on Digital Forensic Investigation on Android Devices

Mobile forensics, particularly in the Android ecosystem, is a rapidly evolving field that demands continuous advancements to address the growing complexity and diversity of mobile devices. This article emphasizes the importance of developing techniques for digitally analyzing Android smartphones, which dominate the smartphone market. The primary objective of this research is to contribute to the development of effective forensic investigation strategies tailored specifically for Android mobile devices, providing insights into the tools and methods used for this purpose. The objective of this study is to improve the precision and effectiveness of forensic examinations pertaining to Android mobile phones. It discusses the fundamental functionality of mobile devices as a source of digital evidence and provides an overview of tools and methodologies for collecting and analyzing such evidence. The importance of comprehending the hardware and software architecture of Android handsets in order to choose the right forensic tools is also highlighted in the article. Furthermore, it proposes future enhancements for Andriller, a popular digital forensic tool, to improve its effectiveness in Android forensic investigations. These enhancements include advancements in data extraction techniques, compatibility with new Android versions, support for additional data types, integration with advanced analysis methods, and addressing identified limitations. Additionally, the paper stresses the need for robust methodologies for conducting cloud forensics on Android devices, particularly in the context of data stored in cloud storage services. The proposed work aims to enhance the capabilities of Andriller and improve the efficiency of digital forensic investigations on Android devices.

Drug-facilitated sexual assault followed by femicidal chloroform poisoning and suffocation: A case-report of criminal responsibility

IntroductionCriminal responsibility evaluation represents one of the most controversial and debated issues in forensic psychiatry. Although clear procedures have been recommended, little research exists on decision-making process by forensic psychiatrists. We present a case assessing the criminal responsibility of a murderer who committed femicide as a result of chloroform poisoning and suffocation after a drug-facilitated sexual assault. Materials and methodsA.S., a 30-year-old female, was found dead in the home of S.P., a 50-year-old male. S.P. recounted killing A.S. by forced inhalation of chloroform, when the woman had experienced sensory clouding following unintentional ingestion of Zolpidem, a hypnotic agent. A multidisciplinary approach was taken to resolve the case. Autopsy, histological, genetic, and toxicological examinations were performed by a forensic pathologist, while a digital forensic examiner analysed electronic devices. A pool of three forensic psychiatrists and two psychologists was asked to assess the mental state of S.P. at the time of the crime. Results and conclusionsThe cause of death of A.S. was identified as a lethal chloroform intoxication in altered consciousness caused by Zolpidem, while homicidal suffocation was also described. Mobile forensics demonstrated that S.P. had videotaped the crime scene, clearly revealing that A.S. had been sexually assaulted by S.P. before dying. Criminal responsibility of S.P. was evaluated through various psychological tests and seven interviews with the accused, each lasting an average of 180 min. Specialists concluded that S.P. could not be exempted from being responsible for the homicide.

Tracking the Route Walked by Missing Persons and Fugitives: A Geoforensics Casework (Italy)

Criminal investigations aiming to track the route walked by missing persons and fugitives (MPFs) usually involve intelligence analysts, military planners, experts in mobile forensics, traditional investigative methods, and sniffer dog handlers. Nonetheless, when MPFs are devoid of any technological device and move in uninhabited rural areas devoid of tele cameras and densely covered by vegetation, tracking the route walked by MPFs may be a much more arduous task. In the XVIII century, the expert Georg Popp was able to link a homicide suspect to a sequence of different sites of criminal interest, located in the countryside, by studying the stains of soils found on the footwear and trousers of the suspect. In such complex cases, a very efficient approach for tracking the route walked by MPFs may consist of comparing the geological traces found on the MPFs and their belongings with soils exposed in the event scenes. In particular, the search for peculiar or rare particles and aggregates may strengthen the weight of the geological forensic evidence comparisons. A match of mineralogical, textural, and organic matter data may demonstrate the provenance of the traces from the soil of a specific site, thereby linking the MPFs to the scene of events. Based on the above, the present paper reports geological determinations accomplished for a “mediatic” casework. The results allowed a general high degree of compatibility among traces collected on the MPFs and on the soil from the scene of events to be ascertained. The most significant positive matches, based on the finding of ten peculiar and rare particles and assemblages, allowed the reconstruction of a route about 1.1 km long, as the crow flies, on the event site. Although this procedure was extremely time consuming and available only in a backwards reconstruction linked to the MPFs’ findings, it was of uttermost importance in strengthening the inferences proposed, and for which other methods could not provide any information.

Mobile Forensic Readiness: A Comprehensive Survey of the Best Practices, Current Methods and Available Data

Our way of life has been completely transformed by mobile phones. Nowadays, a cell phone is seen as a necessary item. Which means we use it for the majority of our tasks as well as communication. Communication is portable allowing us to send texts and make calls from anywhere on the planet. In addition, people can utilize the camera to record significant moments in their life and store them for later reference. People used to send these photos to their loved ones from their phone allows them to share their moments with others. Moreover, through mobile applications, they may interact with individuals from all over the world and create new acquaintances on a mobile phone, Last but not least, they can use smartphone applications for finding their way about acquiring maps. For nefarious purposes, some people, on the other hand, want to wipe all of their data, including phone records, text messages, images, videos, and location information. Therefore, using mobile forensic technologies, a mobile forensic expert can recover all of the erased data, including call logs, text messages, photographs, videos, and location data. This survey paper intends to investigate and assess the state of mobile phone forensic preparation, including a thorough overview of current methodologies and industry best practices. This research intends to help forensic investigators, law enforcement organizations, and digital forensic practitioners create strong and efficient mobile phone forensic preparation strategies by examining various methodology, tools and procedures.

Forensic Operations for Recognizing SQLite Content (FORC): An Automated Forensic Tool for Efficient SQLite Evidence Extraction on Android Devices

Mobile forensics is crucial in reconstructing various everyday activities accomplished through mobile applications during an investigation. Manual analysis can be tedious, time-consuming, and error-prone. This study introduces an automated tool called Forensic Operations for Recognizing SQLite Content (FORC), specifically designed for Android, to extract Simple Query Language Table Database Lightweight (SQLite) evidence. SQLite is a library that serves as a container for mobile application data, employing a zero-configuration, serverless, self-contained, and transactional SQL database engine. While some SQLite files possess extensions such as .db, .db3, .sqlite, and .sqlit3, others have none. The lack of file extensions may result in missing evidence that could unveil the truth. The proposed tool utilizes both the file extensions and headers of the SQLite data to recognize and identify SQLite data generated or modified by a mobile application. The FORC tool’s capability was evaluated using the Chrome application as a case study, and a comparison between FORC and other tools was conducted. The results suggest that FORC significantly simplifies mobile forensic analysis.