A Forensic Analysis of Video Streaming Activities on Android Application

Abstract

The past decade has seen a major shift in electronic media, especially in the entertainment sector. Now, more people are consuming content through digital media, which was earlier being viewed via electronic media. This has given rise to online video streaming platforms which allow users to view content at the time of their convenience as opposed to electronic media where the transmission has a set schedule. Initially, these platforms could only be accessed through their web-based applications, but over time mobile applications were also developed for these video streaming platforms. These applications tend to store personal information and also leave behind remnants of the activities performed even after the application has been uninstalled. These remnants need to be examined to verify whether they violate the privacy of the user. In the scenario where malicious actors gain access to the mobile device of a user, it can prove detrimental for the user. Furthermore, they can also aid in investigations where the law enforcing authorities need to cross-check the alibi of the suspects. A very common use case for this can be a road accident where the law enforcement agencies can prove that the suspect was viewing a video on one of these platforms. This thesis will be examining the android applications of the top three and most popular video streaming platforms which are Netflix, Amazon Prime Video, and iFlix. Amongst the three, Netflix is the most popular and has been present for the longest time. Several video streaming activities will be performed through the above mentioned applications on a rooted android mobile device, after which we will take a physical image for analysis. The goal is to present the artifacts left behind the applications along with the path to their location in a well documented format that will assist the forensic investigators to get a better understanding of the applications’ behavior. It was found that Netflix leaves behinds the most detailed artifacts of the user’s activities whereas iFlix stores the least amount of artifacts on the mobile device.