AmpleDroid Recovering Large Object Files from Android Application Memory

Sudhakaran, Sneha; Ali-Gombe, Aisha; Orgah, Augustine; Case, Andrew; Richard, Golden G.

doi:10.1109/wifs49906.2020.9360906

Cited by 2 publications

(8 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The algorithm uses the RegionSpace allocator, and if the use of TLAB is enabled, the system uses the RegionSpaceTlab allocator for movable objects. On newer Android versions, RegionSpaceTlab (Ali-Gombe et al, 2019) is the default for most small object allocations and LargeObjectSpace (Sudhakaran et al, 2020) for large object allocations. Second, the core Android system components and services like ART are built from native code that relies on native libraries written in C/C++ (ART Platform, 2017).…”

Section: Android Runtime Environmentmentioning

confidence: 99%

“…In Android, object allocation utilizes memory management algorithms based on the size of the object (AndroidLOS, 2017) (Ali-Gombe et al, 2019) (Sudhakaran et al, 2020). Objects with an allocation size of fewer than 12KB are small objects like primitives, strings, arrays, and other complex objects such as InetAddress and are allocated using the Alloc() function (Ali-Gombe et al, 2019).…”

Section: Object Allocation and Deallocationmentioning

confidence: 99%

“…Objects with an allocation size of fewer than 12KB are small objects like primitives, strings, arrays, and other complex objects such as InetAddress and are allocated using the Alloc() function (Ali-Gombe et al, 2019). On the other hand, the AllocLarge() function allocates large objects above a certain threshold of 12KB (Sudhakaran et al, 2020). The small objects are allocated using the region-based memory management algorithm, and the large objects are allocated using the large object space algorithm.…”

Section: Object Allocation and Deallocationmentioning

confidence: 99%

“…The difference in object count was observed in different process states and is described in detail. First, we present a methodology to identify the impact on process memory samples with combinations of external runtime factors on object recovery using some available and free Android userland memory forensic tools (Ali-Gombe et al, 2019) and (Sudhakaran et al, 2020). Next, we evaluated multiple apps and derived a metric Sneha Sudhakaran et ak evaluation criterion for measuring the reliability of userland forensic tools on process memory capture acquired by incorporating the runtime factors during the dump acquisition.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Evaluating the Reliability of Android Userland Memory Forensics

Sudhakaran

Ali-Gombe

Case³

et al. 2022

iccws

Self Cite

View full text Add to dashboard Cite

Memory Forensics is one of the most important emerging areas in computer forensics. In memory forensics, analysis of userland memory is a technique that analyses per-process runtime data structures and extracts significant evidence for application-specific investigations. In this research, our focus is to examine the critical challenges faced by process memory acquisition that can impact object and data recovery. Particularly, this research work seeks to address the issues of consistency and reliability in userland memory forensics on Android. In real-world investigations, memory acquisition tools record the information when the device is running. In such scenarios, each application’s memory content may be in flux due to updates that are in progress, garbage collection activities, changes in process states, etc. In this paper we focus on various runtime activities such as garbage collection and process states and the impact they have on object recovery in userland memory forensics. The outcome of the research objective is to assess the reliability of Android userland memory forensic tools by providing new research directions for efficiently developing a metric study to measure the reliability. We evaluated our research objective by analysing memory dumps acquired from 30 apps in different Process Acquisition Modes. The Process Acquisition Mode (PAM) is the memory dump of a process that is extracted while external runtime factors are triggered. Our research identified an inconsistency in the number of objects recovered from analysing the process memory dumps with runtime factors included. Particularly, the evaluation results revealed differences in the count of objects recovered in different acquisition modes. We utilized Euclidean distance and covariance as the metrics for our study. These two metrics enabled the authors to identify how the change in the number of recovered objects in PAM impact forensic analysis. Our conclusion revealed that runtime factors could on average result in about 20% data loss, thus revealing these factors can have an obvious impact on object recovery.

show abstract

Section: Android Runtime Environmentmentioning

confidence: 99%

Section: Object Allocation and Deallocationmentioning

confidence: 99%

Section: Object Allocation and Deallocationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Evaluating the Reliability of Android Userland Memory Forensics

Sudhakaran

Ali-Gombe

Case³

et al. 2022

iccws

Self Cite

View full text Add to dashboard Cite

show abstract

“…Android memory forensics is used to perform post‐mortem analysis on Android memory dumps to recover and reconstruct vital in‐memory evidence in digital crime investigations [53]. Recovery of forensic evidence from the Android Runtime (ART) includes both kernel [54] and user space [55].…”

Section: Limitations and Future Scopementioning

confidence: 99%

Forensic analysis of Twitch video streaming activities on Android

Alzahrani

Wani

Bhat

2021

Journal of Forensic Sciences

View full text Add to dashboard Cite

Video streaming abuses range from copyright infringement and piracy to child sexual abuse and murder. This paper performs proactive forensics of Twitch video streaming activities on Android devices. We designed our experiments using a methodology based on black-box testing principles and conducted them on Android devices using a forensic framework. The results of our experiments suggest that forensic investigators can extract evidences of streams broadcast, shared, and watched by the user, and associate them with the Twitch account of the user. We detail all the recoverable artifacts of forensic significance, provide mechanisms to extract them based on the identified anchors, and interpret their significance in forensic investigations.

show abstract

AmpleDroid Recovering Large Object Files from Android Application Memory

Cited by 2 publications

References 8 publications

Evaluating the Reliability of Android Userland Memory Forensics

Evaluating the Reliability of Android Userland Memory Forensics

Forensic analysis of Twitch video streaming activities on Android

Contact Info

Product

Resources

About