Comparative Forensics Analysis of Android Smartphones for Users Data Profiling

Abstract

Tremendous technological development flare-up people's access to data through smartphones despite time and place. As a result of the extensive use and interest of the user in mobile applications, their dependence on smartphones has raised. Extensive data regarding user activities can be gathered from these devices. Mobile forensics, difficult as it is to conduct due to the end-to-end encryption provided by different smartphone companies and applications for security purposes. The strong encryption-based security makes it harder to carry out mobile forensics efficiently without modifying the information. It is therefore a challenging but essential task in forensic analysis. This research presents profiling of user activities through comparative study as mentioned on the above problem using NIST methodology; bit-by-bit image(s) of android phones are analyzed for exploring and retrieving important artifacts of user activities. The motive of this research is the identification and classification of a timeline user's daily activities on the device. Further, identify the data remnants left in the android mobile device while using different browsing, social, and phone generalized applications. This study possibly aims to facilitate the forensics investigation process by profiling and comparing data acquired from different smartphones i.e. Xiaomi Redmi Go, and Samsung A2Core non-destructively, which may provide a basis for the task of user data profiling. For this purpose, we conducted logical/physical image acquisitions. In the logical acquisition of an unrooted/rooted smartphone, the systems files are acquired and evaluated the identified evidence, profiled, and then compared for both devices. For physical acquisition memory image of a rooted android smartphone is acquired and evidence found is used to make a timeline of user activities. The artifacts collected from these devices are presented will also assist forensics investigators to have a better insight into the behavior (on basis of the amount/type/remnants of artifacts of user activities found on each device) of android smartphones.