Abstract:
Tremendous technological development flare-up people's access to data through
smartphones despite time and place. As a result of the extensive use and interest of the user in
mobile applications, their dependence on smartphones has raised. Extensive data regarding
user activities can be gathered from these devices. Mobile forensics, difficult as it is to conduct
due to the end-to-end encryption provided by different smartphone companies and applications
for security purposes. The strong encryption-based security makes it harder to carry out mobile
forensics efficiently without modifying the information. It is therefore a challenging but
essential task in forensic analysis.
This research presents profiling of user activities through comparative study as
mentioned on the above problem using NIST methodology; bit-by-bit image(s) of android
phones are analyzed for exploring and retrieving important artifacts of user activities. The
motive of this research is the identification and classification of a timeline user's daily activities
on the device. Further, identify the data remnants left in the android mobile device while using
different browsing, social, and phone generalized applications. This study possibly aims to
facilitate the forensics investigation process by profiling and comparing data acquired from
different smartphones i.e. Xiaomi Redmi Go, and Samsung A2Core non-destructively, which
may provide a basis for the task of user data profiling.
For this purpose, we conducted logical/physical image acquisitions. In the logical
acquisition of an unrooted/rooted smartphone, the systems files are acquired and evaluated the
identified evidence, profiled, and then compared for both devices. For physical acquisition
memory image of a rooted android smartphone is acquired and evidence found is used to make
a timeline of user activities.
The artifacts collected from these devices are presented will also assist forensics
investigators to have a better insight into the behavior (on basis of the amount/type/remnants
of artifacts of user activities found on each device) of android smartphones.
