Digital Forensics Triage App for Android

International Conference on Availability, Reliability and Security (ARES), pp. 1–6

Abstract

Digital forensics of smartphones is of utmost importance in many criminal cases. As modern smartphones store chats, photos, videos etc. that can be relevant for investigations and as they can have storage capacities of hundreds of gigabytes, they are a primary target for forensic investigators. However, it is exactly this large amount of data that is causing problems: extracting and examining the data from multiple phones seized in the context of a case is taking more and more time. This bears the risk of wasting a lot of time with irrelevant phones while there is not enough time left to analyze a phone which is worth examination. Forensic triage can help in this case: Such a triage is a preselection step based on a subset of data and is performed before fully extracting all the data from the smartphone. Triage can accelerate subsequent investigations and is especially useful in cases where time is essential. The aim of this paper is to determine which and how much data from an Android smartphone can be made directly accessible to the forensic investigator – without tedious investigations. For this purpose, an app has been developed that can be used with extremely limited storage of data in the handset and which outputs the extracted data immediately to the forensic workstation in a human- and machine-readable format.

Authors 6

1. Jannik Neth Aachen

   FH Aachen

   Affiliation as printed

   FH Aachen University of Applied Sciences, Germany

2. Marko Schuba Aachen

   FH Aachen

   Affiliation as printed

   FH Aachen University of Applied Sciencess, Germany

3. Karsten Brodkorb
   Affiliation as printed

   State Office of Criminal Investigation North-Rhine Westphalia, Germany

4. Georg Neugebauer Aachen

   FH Aachen

   Affiliation as printed

   FH Aachen University of Applied Sciences, Germany

5. Tim Hoener Aachen

   FH Aachen

   Affiliation as printed

   FH Aachen University of Applied Sciences, Germany

6. Sacha Hack Aachen

   FH Aachen

   Affiliation as printed

   FH Aachen University of Applied Sciences, Germany