Towards a Unified Forensic Investigation Framework of Smartphones

Abstract

Abstract-In recent years advanced capabilities of smartphones have enabled their users to store and manage copious information about their personal and professional life. Consequently, any seized smartphone might involve some useful evidence.However a wide variety of manufacturers, different operating systems, enormous hardware components and a huge number of programs that smartphones are using make it difficult to reach a unified forensic framework for all models. This paper firstly reviews the previous works on remote and local data acquisition methods from smartphones. Afterwards, it reports difficulties in analyzing and examining retrieved data from smartphones. Additionally, it evaluates current forensic investigation process models in relation to smartphones in order to find a suitable model that can be applied to all smartphones forensic investigations. This paper proposes solutions for addressing data acquisition, data examination, and investigation process model to ultimately come towards a unified framework for investigation of smartphones.Index Terms-Mobile forensics, smartphone investigation, forensic framework. I. INTRODUCTIONBased on statistics published by Gartner [1] in the third quarter of 2010 smartphone sales have been raised to 96 percent from the third quarter of 2009. It is also expected that the number of smartphone users exceeds to the one billion by 2013 [2].Smartphones with sophisticated capabilities and features facilitate storing different kinds of information of their owners and any piece of this information is potentially precious evidence.In spite of many similarities between smartphones, the structure and configuration of each model is different from another one. There are a wide variety of operating systems, applications, and hardware components that are used in different models of smartphones. Additionally, a lot of worthy information stored on smartphones is volatile.Notwithstanding existence of different software and hardware tools for data gathering from cell phones, none of them can recover all data without making alteration.Moreover, almost every day new applications for smartphones are released. Even if the data is being successfully recovered, still there might be various barriers in examining some data like encrypted ones.Another major issue in smartphone forensics is nonexistence of any widely accepted standard investigation process model. This paper reviews two common data acquisition methods to find a proper approach for gathering data from smartphones. Data examining and its obstacles to smartphone forensics are other issues that this paper encompasses. Furthermore, this paper evaluates two investigation process models that are introduced for investigation of Windows Mobile and Symbian operating systems to find an appropriate model which is capable of being employed in all smartphone forensic investigations. II. LITERATURE REVIEWThe crux of smartphone forensics is narrowing down the following issues:Determining the most appropriate data acquisition method;Examining c...

Forensics Analysis of Skype, Viber and WhatsApp Messenger on Android Platform

“…The forensic examination on BlackBerry was conducted in [8], and it described few methods of examination which include using forensic tools while [9] proposed a framework for investigation of Samsung Phones. Several researchers have proposed various framework for the investigation of Nokia mobile devices and for Firefox OS [10], [11]. The research carried out in [12] shows that artifact such as SMS, logs, MMS, photos, videos, calendar notes, emails, browser history and web bookmarks can be extracted from the internal storage of any mobile device.…”

“…More so, an acquisition methodology based on overwriting the "Recovery" partition on the Android device's SD card with specialized forensic acquisition software was discussed in [20]. Indicators to measure performance of mobile forensic data acquisition techniques in Firefox OS were developed in [21] while a unified framework for investigation of different types of smartphone devices was developed in [22].…”

Analisis Investigasi Forensik WhatsApp Messanger Smartphone Terhadap WhatsApp Berbasis Web

“…[1] Berdasarkan pernyataan peneliti terdahulu diatas dapat dikembangkan Analisis Investigasi Forensik WhatsApp Messengersmartphone terhadap WhatsApp berbasis Web dengan studi kasus penyadapan percakapan WhatsApp, dengan mempertimbangkan beberapa aspek seperti pernyataan peneliti terdahulu penelitian lanjutan dihadapkan pada berbagai jenis perangkat smartphone selama penanganan kasus investigasi forensik [7]. Perangkat smartphone saat ini menjadi sumber penting digital evidence yang relevan dengan pengguna media sosial dan aktivitas instan Messenger [13]. Namun, perbedaan antara perangkat smartphone menjadi tantangan penyidik atau investigator forensik untuk mengembangkan metode dan teknik yang disesuaikan untuk penyelidikan berbagai kasus cybercrime [11].…”

Analisis Kelayakan Integrated Digital Forensics Investigation Framework Untuk Investigasi Smartphone

“…Smartphone forensic investigation process model (SFIPM) dirancang khusus untuk penanganan smartphone forensics terdiri dari beberapa tahapan, yaitu (1 (Mohtasebi & Dehghantanha, 2013).…”