Forensic Data Extraction and Analysis of Left Artifacts on emulated Android Phones: A Case Study of Instant Messaging Applications

Abstract

The fast-growing nature of instant messaging applications usage on Android mobile devices brought about a proportional increase on the number of cyber-attack vectors that could be perpetrated on them. Android mobile phones store significant amount of information in the various memory partitions when Instant Messaging (IM) applications (WhatsApp, Skype, and Facebook) are executed on them. As a result of the enormous crimes committed using instant messaging applications, and the amount of electronic based traces of evidence that can be retrieved from the suspect’s device where an investigation could convict or refute a person in the court of law and as such, mobile phones have become a vulnerable ground for digital evidence mining. This paper aims at using forensic tools to extract and analyse left artefacts digital evidence from IM applications on Android phones using android studio as the virtual machine. Digital forensic investigation methodology by Bill Nelson was applied during this research. Some of the key results obtained showed how digital forensic evidence such as call logs, contacts numbers, sent/retrieved messages, and images can be mined from simulated android phones when running these applications. These artefacts can be used in the court of law as evidence during cybercrime investigation.

Examining artifacts generated by setting Facebook Messenger as a default SMS application on Android: Implication for personal data privacy

“…As the author pointed, the objective of introducing SMS feature was to shift away messenger users from their default mobile phone Messages application and see them spend more time in the Messenger application. Derek Walter in Reference 28 claimed that the Messenger application does not save or store any of the SMS in its servers. Indeed, from the experimentation results, it has been shown that it is true that Messenger does not store any SMS in its servers.…”

“…Instant messaging software such as Fetion, Skype Messenger, Facebook Instant Messenger, Yahoo Messenger, eBuddy, and WhatsApp Instant Messaging are the most popular and commonly used IM applications. 38,39 A research paper authored by Avis 2 indicated that criminals and violent extremists could use social media applications as a platform for; information exchange, carrying out recruitment and training, planning attacks, conducting fundraising, and spreading of terrorist's propaganda in developing countries. Kenya being a developing country has indeed experienced some occurrences where terrorists have orchestrated their activities through social media applications.…”

“…One significant criminal activity affecting national security in many countries across the world is terrorism which is influenced by instant messaging applications. Instant messaging software such as Fetion, Skype Messenger, Facebook Instant Messenger, Yahoo Messenger, eBuddy, and WhatsApp Instant Messaging are the most popular and commonly used IM applications 38,39 . A research paper authored by Avis 2 indicated that criminals and violent extremists could use social media applications as a platform for; information exchange, carrying out recruitment and training, planning attacks, conducting fundraising, and spreading of terrorist's propaganda in developing countries.…”

Logical Image Acquisition and Analysis of Android Smartphones

“…A vast quantity of data can be stored on Android smartphones [2]. The information available on an Android phone encompasses fundamental details, data from various applications, multimedia content, call histories, contact details, images, sent and received messages, as well as the chat applications database like What-sApp database [3]. It is foreseen that artificial intelligence can be used to detect crime-related data among this vast amount of data [4].…”

Android Permission Classifier: a deep learning algorithmic framework based on protection and threat levels

“…Malware attacks on mobile devices have become one of the most dreaded and precarious threats causing economic and information impairments. The study of Ashawa et al 1,2 asserted that the increase and fast‐growing rate at which mobile applications are been used in the 21st century has caused a proportionate growth in the number of cyber‐attacks one of which is malware attacks on mobile and personal computers. Though, malicious applications target different mobile OS platforms, malware targeting Android has become a massive surge recently.…”