Efficient Smart Phone Forensics Based on Relevance Feedback

Varma, Saksham; Walls, Robert J.; Lynn, Brian; Levine, Brian Neil

doi:10.1145/2666620.2666628

Cited by 5 publications

(4 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Varma et al [44] present a system, called LIFTR, for prioritizing the information recovered from Android phones. The initial data for the system is a forensic image extracted by a recovery engine.…”

Section: Triage Of Mobile Devicesmentioning

confidence: 99%

“…The basic idea is that the recovery engine returns many unrelated items to the investigated crime results, since it does not consider the semantics behind the recovered content. Varma et al [44] explore the filesystem of the Android phones and learn the rules of storing the information. These rules learnt and the feedback from the examiner form the basis for information prioritizing.…”

Section: Triage Of Mobile Devicesmentioning

confidence: 99%

“…The information recovery engine DEC0DE, offered by Walls et al [43] and the information prioritization system LIFTR, which uses the data obtained from DEC0DE, offered by Varna et al [44] To summarize the field of triage tools, the noteworthy research achievements are as follows:…”

Section: Lessons Learned From the Reviewmentioning

confidence: 99%

See 2 more Smart Citations

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

2017

View full text Add to dashboard Cite

Digital triage is the first investigative step of the forensic examination. The digital triage comes in two forms, live triage and post-mortem triage. The primary goal of the live triage is a rapid extraction of an intelligence from the potential sources. The live triage raises legitimate concerns. The post-mortem triage is conducted in the laboratory and its main goal is ranking of the seized devices for the possible existence of the relevant evidence. The digital triage has the potential to quickly identify items that are likely to contain the evidential data. Therefore, it is a solution to the problem of case backlogs. However, existing methods and tools of the digital triage have limitations, especially, in the forensic context. Nevertheless, we have no better solution for the time being. In this paper, we critically review published research works and the proposed solutions for digital triage. The review is divided into four sections as follows: live triage, post-mortem triage, mobile device triage, and triage tools. We conclude that many challenges are awaiting for the developers in creating methods and tools of digital triage in order to keep pace with the development of new technologies.

show abstract

Section: Triage Of Mobile Devicesmentioning

confidence: 99%

Section: Triage Of Mobile Devicesmentioning

confidence: 99%

See 1 more Smart Citation

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

2017

View full text Add to dashboard Cite

show abstract

“…The idea of performing triage in Android is not new [7,44]. MAST [7] uses Multiple Correspondence Analysis (MCA) to rank applications based on metadata features.…”

Section: Related Workmentioning

confidence: 99%

Combining static analysis with probabilistic models to enable market-scale Android inter-component analysis

et al. 2016

View full text Add to dashboard Cite

Static analysis has been successfully used in many areas, from verifying mission-critical software to malware detection. Unfortunately, static analysis often produces false positives, which require significant manual effort to resolve. In this paper, we show how to overlay a probabilistic model, trained using domain knowledge, on top of static analysis results, in order to triage static analysis results. We apply this idea to analyzing mobile applications. Android application components can communicate with each other, both within single applications and between different applications. Unfortunately, techniques to statically infer Inter-Component Communication (ICC) yield many potential inter-component and interapplication links, most of which are false positives. At large scales, scrutinizing all potential links is simply not feasible. We therefore overlay a probabilistic model of ICC on top of static analysis results. Since computing the inter-component links is a prerequisite to inter-component analysis, we introduce a formalism for inferring ICC links based on set constraints. We design an efficient algorithm for performing link resolution. We compute all potential links in a corpus of 11,267 applications in 30 minutes and triage them using our probabilistic approach. We find that over 95.1% of all 636 million potential links are associated with probability values below 0.01 and are thus likely unfeasible links. Thus, it is possible to consider only a small subset of all links without significant loss of information. This work is the first significant step in making static inter-application analysis more tractable, even at large scales.

show abstract

Advances in the application of Ontologies in the area of Digital Forensic Electronic Mail

Parra

Vegetti

Leone

2019

IEEE Latin Am. Trans.

View full text Add to dashboard Cite

Efficient Smart Phone Forensics Based on Relevance Feedback

Abstract: ABSTRACT

Cited by 5 publications

References 13 publications

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

Combining static analysis with probabilistic models to enable market-scale Android inter-component analysis

Advances in the application of Ontologies in the area of Digital Forensic Electronic Mail

Contact Info

Product

Resources

About