Acquisition and Analysis of Digital Evidence in Android Smartphones

Abstract

From an expert's standpoint, an Android phone is a large data repository that can be stored either locally or remotely. Besides, its platform allows analysts to acquire device data and evidence, collecting information about its owner and facts under investigation. This way, by means of exploring and cross referencing that rich data source, one can get information related to unlawful acts and its perpetrator. There are widespread and well documented approaches to forensic examining mobile devices and computers. Nevertheless, they are neither specific nor detailed enough to be conducted on Android cell phones. These approaches are not totally adequate to examine modern smartphones, since these devices have internal memories whose removal or mirroring procedures are considered invasive and complex, due to difficulties in having direct hardware access. The exam and analysis are not supported by forensic tools when having to deal with specific file systems, such as YAFFS2 (Yet Another Flash File System). Furthermore, specific features of each smartphone platform have to be considered prior to acquiring and analyzing its data. In order to deal with those challenges, this paper proposes a method to perform data acquisition and analysis of Android smartphones, regardless of version and manufacturer. The proposed approach takes into account existing techniques of computer and cell phone forensic examination, adapting them to specific Android characteristics, its data storage structure, popular applications and the conditions under which the device was sent to the forensic examiner. The method was defined in a broad manner, not naming specific tools or techniques. Then, it was deployed into the examination of six Android smartphones, which addressed different scenarios that an analyst might face, and was validated to perform an entire evidence acquisition and analysis.

A critical review of 7 years of Mobile Device Forensics

“…This way, a satisfying level of security is preserved. While the Android Runtime Libraries are written in Java (Yates, 2010), DVM translates Java to a language that the OS can perceive (Simao et al, 2011). The rest of the architecture consists of the Applications Framework and the Applications Layer that manage general application structure, such as containers, alerts and the applications themselves.…”

“…Adb uses a TCP or USB connection between a mobile device and a computer. The appropriate software is installed at both sides in order to acquire debugging information, start a shell session with the provided interface, initiate file transactions and add or remove applications (Hoog, 2011;Simao et al, 2011;Vidas et al, 2011). Since adb grants a terminal interface, actions like rooting and memory image extraction can be easily performed.…”

“…Since Google swapped the file system type to EXT4, such a research would be useful for the older devices, but outdated. Simao et al (2011) proposed a forensic acquisition framework for the Android OS. Their framework has been presented in a flowchart form, since there had been many different states of target devices, such as rooted or not, switched on or off, upon access control or not.…”

“…The additional information in their proposal concerned acquisition on damaged devices and fragmented memory page analysis. In order to validate the effectiveness of the model, (Simao et al, 2011) conducted experiments on devices with different conditions and figured out that the proposed scheme was applicable. However, they admitted that further research should be conducted so as the framework can be kept up to date with the upcoming versions of Android.…”

“…The flowchart proposed in this work can be considered an extended version of the one demonstrated by Simao et al (2011). By the time the research was undertaken, the process model was applicable only to Android and iOS devices.…”