Digital forensic artifacts of the Your Phone application in Windows 10

Domingues, Patrício; Frade, Miguel; Andrade, Luís; Silva, João Victor

doi:10.1016/j.diin.2019.06.003

Cited by 9 publications

(3 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are many challenges in the field of mobile forensics, one of which is limited resources, in the sense that the rapid development of mobile technology and the increase in the number of smartphone devices are not matched by the development of mobile forensic technology and the development of mobile forensic technology [29,30]. Existing forensic tools to overcome these challenges need to do a comparative analysis of instant messaging features and forensic tools [31,32].…”

Section: Literature Reviewmentioning

confidence: 99%

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Riadi¹,

Yudhana²,

Pramuja³

et al. 2023

IJSSE

View full text Add to dashboard Cite

The advancement of new technology is quickening. Because of the features and applications available on mobile devices, smartphones are gradually taking over the role of computers. One of them is a multi-platform instant messaging application with various features that can bring people together, but the negative aspect is that it is used to commit digital crimes. Digital evidence is required in the investigation of digital crimes, In order to obtain digital evidence, a set of forensic tools is required to carry out the forensic process of physical evidence. The goal of this research is to describe and contrast the forensic process. These tools are currently based on digital evidence obtained through the stages of the Digital Forensic Research Workshop. MEF, DB4S, OFD, and FMF are the forensic tools used in this study. According to the findings, FMF has the highest extraction capability for obtaining digital evidence, OFD has advantages in terms of data acquisition features, and MFE has advantages in identification, physical evidence preservation, and cloning.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Riadi¹,

Yudhana²,

Pramuja³

et al. 2023

IJSSE

View full text Add to dashboard Cite

show abstract

“…The CSEM content found on an iPhone, for example, is potentially on any computer that the phone was connected to and backed up to an iCloud account. Additionally, features like device backups and automated restore points may mean the same content is further propagated to removable media or other locations within the same media (Boucher and Le-Khac, 2018; Chung et al, 2017; Domingues et al, 2019). By treating each device as part of an ecosystem and identifying vectors for potential CSEM propagation within a user’s systems, further external distribution can be identified, and the investigators can ensure all relevant copies of content are seized to prevent the facilitation of future recidivating behaviour.…”

Section: Digital Forensicsmentioning

confidence: 99%

Improving child sexual exploitation material investigations: Recommendations based on a review of recent research findings

Steel

Newman

O’Rourke

et al. 2022

The Police Journal: Theory, Practice and Principles

View full text Add to dashboard Cite

Child sexual exploitation material (CSEM) investigations have emerged as an area of specialization that combines multiple skillsets. Recent research has reshaped how we view CSEM offenders – they have different offense-supportive cognitions from contact sex offenders, their use of technology is no longer based on anecdotal evidence, and approaches to investigative planning, interviewing and forensics have evolved. This paper summarizes select, relevant areas of recent research related to CSEM investigations, and makes evidence-based recommendations for evolving how we approach these efforts. Current trends from other domains, including contact tracing and mental health considerations in a remote-working environment are additionally addressed.

show abstract

“…Significantly, as no single tool can parse all the data from the mobile phone, it is vital that the examiner have sound knowledge of file systems structures to recover all the data that tools cannot process. According to Domingues et al, 22 this phase is followed by verification process to determine the accuracy of the acquired data by comparing the extracted data to the data on the mobile phone to identify any possible discrepancies. It also uses a variety of tools to compare the results to identify any differences using hash values to identify if data on the images has changed since acquisition.…”

Section: Introductionmentioning

confidence: 99%

Examining artifacts generated by setting Facebook Messenger as a default SMS application on Android: Implication for personal data privacy

Ntonja

Ashawa

2020

Security and Privacy

View full text Add to dashboard Cite

The use of mobile devices and social media applications in organized crime is increasingly increasing. Facebook Messenger is the most popular social media applications used globally. Unprecedented time is spent by many interacting globally with known and unknown individuals using Facebook. During their interaction, personal information is uploaded. Thus, crafting a myriad of privacy trepidation to users. While there are researches performed on the forensic artifacts' extraction from Facebook, no research is conducted on setting Facebook Messenger applications as a default messaging application on Android. Two Android mobile devices were used for data generation and Facebook Messenger account was created. Disc imaging and data partition were examined and accessed to identify changes in the orca database of the application package using DB browser. The data were then generated using unique words which were used for conducting key searches. The research discovered that mqtt_log_event0.txt of the Com.Facebook.orca/Cache directory stores chat when messenger is set as a default messaging app. The research finding shows that chats are recorded under messages tab together with SMS of data/data/com.facebook.orca/databases/smstakeover_db and data/data/com.facebook.orca/databases/threads_db. This indicates that only smstakeover_db stores SMS messaging information when using messenger application. It is observed that once the user deletes a sent SMS message, the phone number and the deleted time stamp remained in the data/data/com.facebook.orca/databases/smstakeover_db database in the address_table are recoverable. The results suggest that anonymization of data is essential if Facebook chats are to be shared for further research into social media content.

show abstract

Digital forensic artifacts of the Your Phone application in Windows 10

Cited by 9 publications

References 25 publications

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Improving child sexual exploitation material investigations: Recommendations based on a review of recent research findings

Examining artifacts generated by setting Facebook Messenger as a default SMS application on Android: Implication for personal data privacy

Contact Info

Product

Resources

About