Abstract:It is not uncommon that mobile phones are involved in criminal activities, e.g., the surreptitious collection of credit card information. Forensic analysis of mobile applications plays a crucial part in order to gather evidences against criminals. However, traditional forensic approaches, which are based on manual investigation, are not scalable to the large number of mobile applications. On the other hand, dynamic analysis is hard to automate due to the burden of setting up the proper runtime environment to accommodate OS differences and dependent libraries and activate all feasible program paths. We propose a fully automated tool, Fordroid for the forensic analysis of mobile applications on Android. Fordroid conducts inter-component static analysis on Android APKs and builds control flow and data dependency graphs. Furthermore, Fordroid identifies what and where information written in local storage with taint analysis. Data is located by traversing the graphs. This addresses several technique challenges, which include inter-component string propagation, string operations (e.g., append) and API invocations. Also, Fordroid identifies how the information is stored by parsing SQL commands, i.e., the structure of database tables. Finally, we selected 100 random Android applications consisting of 2841 components from four categories for evaluation. Analysis of all apps took 64 h. Fordroid discovered 469 paths in 36 applications that wrote sensitive information (e.g., GPS) to local storage. Furthermore, Fordroid successfully located where the information was written for 458 (98%) paths and identified the structure of all (22) database tables.

An android social app forensics adversary model

Forensic Taxonomy of Popular Android mHealth Apps

Toward social media forensics through development of iOS analyzers for evidence collection and analysis

Mobile Cloud Forensics: An Analysis of Seven Popular Android Apps

Automated forensic analysis of mobile applications on Android devices.

Visible Forensic Investigation for Android Applications by Using Attack Scenario Reconstruction.

Forensics Analysis of Android Mobile VoIP Apps

Dissecting Android Malware: Characterization and Evolution

Digital Forensics Security Analysis on iOS Devices

Android Malware Forensics: Reconstruction of Malicious Events

A Visualization Approach to Analyze Android Smartphone Data

A General Forensics Acquisition For Android Smartphones With Qualcomm Processor

Forensic Analysis of Third Party Location Applications in Android and iOS

A Forensic Analysis of Video Streaming Activities on Android Applications

An Anti-Forensics Method Against Memory Acquiring for Android Devices

Research on Digital Forensics of Smart Devices

Mobile Phone Forensics: An Investigative Framework based on User Impulsivity and Secure Collaboration Errors

A Forensics Method for Android Devices Based on the Technique of Temporary Root

Forensic analysis of TikTok application to seek digital artifacts on Android smartphone

Robust Smartphone App Identification via Encrypted Network Traffic Analysis

Forensic Investigation of Social Media and Instant Messaging Services in Firefox OS: Facebook, Twitter, Google+, Telegram, OpenWapp and Line as Case Studies