Analysis of Skype Digital Evidence Recovery based on Android Smartphones Using the NIST Framework

Abstract

Cybercrime is an activity utilizing electronic devices and network technology as tools or media to commit crimes. One of them uses the Skype application that is installed on the smartphone. In finding evidence from a cybercrime case, a forensic activity known as digital forensic must be carried out. This study aims to recover digital evidence that has been erased using the NIST framework and forensic tools such as Oxygen and Belkasoft. The results of digital evidence recovery from smartphone Samsung J2 in the removal scenario via the application manager, the Oxygen tool cannot recover deleted data and the percentage of success using Belkasoft is 26%. While the results of data recovery with the manual removal method the percentage of success using Oxygen was 63% and Belkasoft was 44%. Digital evidence recovery results from smartphones Andromax A on the erase scenario through the application manager, Oxygen and Belkasoft tools cannot recover deleted data. While manual removal of Oxygen by 61% and Belkasoft cannot restore data. It can be concluded the results of data recovery from both smartphones that are used according to the erasure method through the application manager, Belkasoft has better performance than Oxygen, and data recovery according to the method of erasing manually, Oxygen has better performance than Belkasoft.

Data Recovery Comparative Analysis using Open-based Forensic Tools Source on Linux

“…Using digital forensic tools to aid data capture, Wilson & Chi outline efforts to provide data recovery solutions for digital evidence on a storage device like a smartphone. Since there are numerous ways to obtain and recover data, the recovery method is the most crucial factor [23]. Using a live forensics procedure with the Formost recovery program or Testdisk recover is the suggested solution for flawless data recovery.…”