FADE: A forensic image generator for android device education

Abstract

Realistic case studies are essential to training successful digital forensics examiners. However, the generation of realistic datasets is time‐consuming and resource taxing. This paper presents a technical solution that populates Android emulators with realistic mobile forensic data. The emulator's data can be extracted into a raw disk image that is usable in mobile forensic training scenarios. In addition, the tool allows a user to populate the Android emulators with custom text messages, phone contacts, phone calls, and files. This population task is achieved by utilizing the Android Debug Bridge, Android Content Providers, SQLite databases, and the NodeJS runtime environment. This paper presents the software design and development, the requirements and limitations, and the testing process implemented in this research. The contribution of this paper is twofold. First, it identifies potential data and mechanisms to generate Android mobile forensic datasets using customized data population. Second, it creates a foundation for future research on the topic of mobile forensic emulators for training purposes. This article is categorized under: Digital and Multimedia Science > Mobile Forensics Crime Scene Investigation > Education and Formation