A Review of Mobile Forensic Investigation Process Models

Abstract

Mobile Forensics (MF) field uses prescribed scientific approaches with a focus on recovering Potential Digital Evidence (PDE) from mobile devices leveraging forensic techniques. Consequently, increased proliferation, mobile-based services, and the need for new requirements have led to the development of the MF field, which has in the recent past become an area of importance. In this article, the authors take a step to conduct a review on Mobile Forensics Investigation Process Models (MFIPMs) as a step towards uncovering the MF transitions as well as identifying open and future challenges. Based on the study conducted in this article, a review of the literature revealed that there are a few MFIPMs that are designed for solving certain mobile scenarios, with a variety of concepts, investigation processes, activities, and tasks. A total of 100 MFIPMs were reviewed, to present an inclusive and up-to-date background of MFIPMs. Also, this study proposes a Harmonized Mobile Forensic Investigation Process Model (HMFIPM) for the MF field to unify and structure whole redundant investigation processes of the MF field. The paper also goes the extra mile to discuss the state of the art of mobile forensic tools, open and future challenges from a generic standpoint. The results of this study find direct relevance to forensic practitioners and researchers who could leverage the comprehensiveness of the developed processes for investigation.INDEX TERMS Mobile forensics, investigation process model, digital forensics.

Research Challenges and Opportunities in Drone Forensics Models

“…The method employed with their respective processes is further highlighted in Figure 2. This method, adapted a design science research approach, as explored in similar studies [12][13][14]. The topic for the present study was selected using questions concerning the main subject of the research and considering the background of the topic of focus.…”

Forensic analysis of Twitch video streaming activities on Android

“…Twitch is a proprietary and closed-source software, which means knowledge of its implementation (such as source code, programming language used, and engineering design employed) is not publicly available. Therefore, we developed a methodology based on blackbox testing principles for this study [46,47]. This methodology aims to identify forensically relevant streaming functions of Twitch, prepare test-cases for their execution, and list possible evidences of execution of each test-case that are expected to be identified and extracted during forensic analysis.…”

“…Twitch is a proprietary and closed‐source software, which means knowledge of its implementation (such as source code, programming language used, and engineering design employed) is not publicly available. Therefore, we developed a methodology based on black‐box testing principles for this study [46,47].…”

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

“…In the past, several authors identified several challenges in digital investigation processes [73], [166]- [172], mainly related to the chain of custody preservation, the growth of the data to be processed, and privacy and ethical issues when collecting such data. In addition, our research methodology identified several literature reviews which discussed the challenges and limitations of forensic frameworks.…”