Forensic Tool for Android Mobile Device

Page 1

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

Forensic Tool for Android Mobile Device

Abstract - Mobile devices are the major platform for users to transfer and exchange diverse data for communication. Not just limited to communication, the rich set of diverse mobile applications have made mobile a widespread device all over the world. Market research reports from Forrester estimate the global mobile penetration to be around 50% in 2017 and is forecast to reach 66% by 2022. In India, Mobile penetration using smartphones has reached around 50% as of 2022 from 0.1% in 1998. The usability of mobile applications spreads across domains like banking, personal digital assistant, remote working, e commerce, internet access, entertainment and medical usage. Due to the increasing usage of mobile devices, numerous mobile security issues and data privacy threats are challenging both manufacturers and users. Mobile devices are an ideal target for various security issues and data privacy threats in a mobile ecosystem. Also the need for forensic extraction of data from a particular mobile device is an important aspect for the evidence. The forensic analysis helps extract, analyze the data stored on a mobile device along with its metadata, path locations, databases etc. that are not visible to the mobile user otherwise. In this paper, we have presented a detailed study on mobile hardware/software architecture, Android mobile Operating System, its vulnerabilities and security model and forensic analysis of Android mobile devices. Finally, a forensic tool is developed to extract the data from an Android mobile device, classify extracted data as safe or malicious and present it in well formatted reports.

Key Words: Android, forensics, data extraction, mobile, malicious,report

1.INTRODUCTION

Mobilephoneshavewitnessedaremarkablegrowthinthe pastfewyearsowingtoconveniencefactorslike portability, ubiquity, highperformanceandlowpowerconsumptionof mobile processors and storage chips, high resolution touchscreen, high speed wireless networks and the convenientavailabilityofdiverseapps.Amongtheleading mobile OS platforms, Android is on the majority of smartphonesinmostcountriesintheworldwithashareof 82.8%withsignificantincreaseduringthepasttwodecades. Rich contentmobileapplicationsfurtherpenetratedailylife beyond the basic communication use, which makes usage patternsshiftfromdesktoptomobiledevicesatavigorous pace making mobile devices and applications become an indispensablepartofourdailylife.

Thus,theawarenessoftheimportanceofprivacyprotection, data usage and details about the resident data on mobile

devices has driven the demand for Mobile security and Forensics. Although each smartphone OS developer has supportedspecificsecuritymeasures,maliciouscodeshave madetheirwaytothemobiledevices.Theresidentdatahas beenthemaintargetfortheseattacksanditisimportantto knowandunderstandthedomainofdataprotectionalong with data extraction and validation for investigation purposes.

Thesciencebehindrecoveringdigitalevidencefrommobile phones is called mobile forensics[1]. Digital evidence is definedasinformationanddatathatisstoredon,received, or transmitted by an electronic device that is used for investigations.

This paper briefs about topics like mobile architecture, Android operating system, its vulnerabilities, attacks, securitymodelandforensics.Lastly,aforensictoolhasbeen implemented to extract the data from an Android mobile devicewiththehelpofadumpfile.Thetoolfurtherproceeds toclassifyextracteddataassafeormaliciousandpresentit inwell formattedreports.

2.LITERATURE REVIEW

2.1

Mobile Architecture

Mobile Hardware Architecture:

© 2022,
|
|
Certified Journal | Page2097
IRJET
Impact Factor value: 7.529
ISO 9001:2008
Kush Dabade1 , Parijat Dhalkar2 , Siddhesh Bandgar3 , Anshul Shende4
1,2,3,4
B. Tech Student, Dept. of Computer Engineering and IT, VJTI College, Mumbai, Maharashtra, India
***

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

Themainusecaseofasmartphoneistoexecuteapplication software. The software gets executed with the help of an application processor often taking help from a graphics processor for rendering scenes and whenever the applicationprocessorofthegraphicsprocessorneedsdatait will access the main memory which is dynamic random accessmemory.Betweentheapplicationsoftwareandthe application processor sit two elements one is the drivers thatarenecessaryforhandlingvarioustypesofI/Ocallsand aruntimesystemorthemiddlelayerwhichtheapplication software takes help off to execute various types of application programs[2]. The I/O devices present are for example the Global Positioning System, Display and the Touchscreen,Keyboard,Camera,Microphone,Speakerand soon.Thecommunicationishandledbyamodemprocessor which receives all the signals and passes them on to the operating system and the baseband radio interface. The radio interface communicates with the transmitter and receiverandalsotheSIMcard.Thetwodifferentoperating systems residing on the application processor and the modernprocessorusuallycommunicatewitheachotherfor handlingdatacommunicationbetweenthesetwomodules. 

Software Architecture

Android architecture contains a number of componentstosupportanyandroiddeviceneeds.Android software contains an open source Linux Kernel having a collectionofC/C++librarieswhichareexposedthroughan application framework. Among all the components Linux Kernel provides main functionality of operating system functionstosmartphonesandDalvikVirtualMachine(DVM) providesaplatformforrunninganandroidapplication.

Themaincomponentsofandroidarchitectureare following:

1. Applications

2. ApplicationFramework

3. AndroidRuntime

4. PlatformLibraries

5. LinuxKernel

2.2 Study of Android Attacks and Security model

Android File System

Therearesixprimarylogicalpartitionsunderthe Androidfilesystem[3].

/boot partition consists of the Android kernel and the ramdisk.

/systempartitionaccommodatestheentireAndroidOS.This includes the Android GUI as well as the system apps that comepre installedonAndroiddevices.

/recovery partition is designed for backup and can be considered the alternative boot option or partition in an Androiddevice.

/data partition consists of all of the user’s data, including contacts,settings,appsandmessages.

/cachepartitionstoresthefrequentlyaccessedappdataand components.Clearingcachealsofreesupsomespaceinyour deviceandcanalsofixcertainissuesattimes.

/misc partition contains all the miscellaneous system settings like on/off switches, carrier or region ID, USB configuration,andcertainhardwaresettings.

Vulnerabilities, attacks on Android

1. Attacks on Android architectural layers

The attacks at the kernel layer mainly target root privilege,sandboxing,memory,bootloader,devicedrivers etc. On the other hand, middleware layer attacks target Android architectural components like Hardware Abstraction Layer, libraries and native components. The applicationlayerattacksoccurduringruntimeofmalicious applications.

2. Malware

Malwareisthemalicioussoftwareaimedatprivate specific information which disturbs users, may cause breakdownofthedeviceandleadtoresultssuchascausing information and documents belonging to the user to be stolen or become unusable[4]. The different types of malwaresincludevirus,worm,spyware,trojanhorse,logic bomb,ransomeware,backdoor,rootkitetc.Amalwarecan steal mobile data, record calls, capture images, monitor locationorevenexfiltratedeviceinformation.

3. WiFi based Attacks

Wi Ficonnectionisoneofthesecuritythreatswhich can exploit the vulnerabilities in the Android operating system.Theattackercaneavesdropandaccessthecontent

©
Certified Journal | Page2098
2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

ofAndroidwithouttheuserpermission.Interceptingtraffic letsattackersreadinformationthatwaspreviouslyassumed tobesafelyencrypted.

4. Bluetooth based Attacks

The vulnerability due to bluetooth connection allowsremoteattackerstoruntheirownmaliciouscodeon vulnerabledevicesviaBluetoothLMPpackets.Theattackers canalsousetruncated,oversized,orout of orderBluetooth LMP packets to crash devices altogether. Bluejacking and bluebuggingaretwoofthecommonexamplesofbluetooth basedattacks.

Android OS security model

Android security model consists of the following components[5]:

1. Sandboxing

Application sandbox is a security mechanism through which individual android applications run in their own “space”andcannotinteractwithotherinstalledappsorthe Android OS without proper permissions. The applications areisolated,orsandboxed,bothattheprocesslevelandat thefilelevel.Thesandboxingisdoneatthekernellevelto ensure that each application runs in an isolated environment.

2. Permission Mechanism

Permissionsareaccessrightsthatcancontrolaccessto hardware devices, internet connectivity, data, or OS services.Thesecuritysensitiveinterfacesareprotected by AndroidpermissionsuchasPHONE_CALLS,INTERNET,and SEND_SMS. It means that the application must have the permissiontoperformtheabovetasks.Permissionssupport protection levels namely Normal, Dangerous, Signed, SystemandSigned.

3. Code Signing and Platform keys

Thesesecurityfeaturesareimplementedbycomparing thesigningcertificateofthe currentlyinstalledtargetapp with the certificate of the update or related application. System applications are signed by a number of platform keys.Differentsystemcomponentscanshareresourcesand runinsidethesameprocesswhentheyaresignedwiththe sameplatformkey.

4. Components Encapsulation

Thecomponentsaredeclaredasprivateaswellaspublic. Within the same application, private components are accessible for each other. The public components are accessiblebyotherapplicationswhicharenotinthesame sandboxing, having full accessible permission, but also restrictedthroughwithcustomizedpermission.

5. Multi user support

Thecompositestructure,thetargetphysicaluser’s userIDandtheappIDaseffectiveUIDguaranteesmultiple application instances installed by multiple users get their own sandbox. Additionally, Android also guarantees dedicatedsharedstoragetoeachphysicaluser.

6. SELinux

Security Enhanced Linux (SELinux) is a MAC implementation for the Linux kernel. Mandatory access control(MAC)ensuresthataccesstoresourcesconformsto asystem widesetofauthorizationrulescalledapolicythat canonlybechangedbyanadministratorwhileuserscannot overrideorbypassit.

7. Verified Boot

Android supports verified boot using the verity targetofLinux’sDevice Mapper.Verityprovidestransparent integrity checking of block devices using a cryptographic hashtree.

2.3 Android Forensic Analysis

Mobileforensicsisabranchofdigitalforensicsthat isevolvingintoday'sdigitaleraandisconstantlychanging as new phones are released and operating systems are updated[10]. Android forensics deals with extracting, recovering,andanalyzingdatapresentonanAndroiddevice throughvarioustechniques.Duetotheopennatureofthe Android operating system, these forensic techniques and methods can apply to more than just mobile phones: refrigerators, vehicle entertainment units, televisions, watches,andmanymoredevicesrunAndroid.It'simportant to have a clear understanding of the platform and other fundamentalsbeforewediveinandfindouthowtoextract data.

Followingarethenecessary stepsthatneedto be followedwhileperformingandroidforensicanalysis[6]:

1. Investigationpreparation 2. Seizureandisolation 3. Theacquisitionphase 4. Examinationandanalysis 5. Reporting

Fewandroidplatformtoolsusedintheprocessofforensic analysisareasfollows:

1. Android Software Development Kit

The Android software development kit is the development resource needed to develop Android applications. It includes software libraries and APIs, referencematerials,anemulator,andothertools.

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072 © 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal |

Page2099

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

2. Android Virtual Devices (Emulator)

AndroidVirtualDeviceisavirtualmobiledevice,or emulator, which runs on your computer. The emulator is especially helpful for developers for creating custom applications.Theemulatortakesconsiderableresources.

3. Android Debug Bridge

AndroidDebugBridge(adb)isaversatilecommand linetoolthatletsyoucommunicatewithadevice.[7]Theadb command facilitates a variety of device actions, such as installing and debugging apps, and it provides access to a Unixshellthatyoucanusetorunavarietyofcommandson a device. It is a client server program that includes three components:client,daemonandaserver.

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page2100
1. PhoneInformation 2. Messages 3. CallLogs  Forensics using Andriller AndrillerToolGUI 1. PhoneInformation 2. Contacts 3. Messages
Forensics using ADB

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

3. PROPOSED SYSTEM

3.1Problem Statement

The smartphone market is growing higher and higher.Withthedrasticchangesintechnologyandloadsof extremelyvaluabledata,dataresidentonmobiledevicesare becoming hotspots of target . The usability offered by a variety of mobile applications is adding to sensitive data. The analysis of mobile phones and data extraction could revealSMS,contacts,installedapplications,GPSdata,emails, deleteddata,etc.that canoffersignificantinsights.Android, beingtheleadingmobileoperatingsystem,thedesignofan AndroidForensicanalysistoolisthefocusofthispaperwith abrieflookontopicsdiscussedinLiteraturereview.

TheAndroidForensicanalysistoolshouldprovide the resident data along with the details of data like databases,tables,timestamps,relatedattributesetc.Further thetoolmustclassifydataassafeormalicious.Theresults shouldbepresentedin theformofwell formattedreports. Thetoolshouldbeeasytouseandinteractivewithausable andconvenientinterface.

3.2 Proposed Android Forensic Tool

mobile data and classified accordingly by the tool. The results are finally displayed in interactive, well formatted reports with a usable interface that can be viewed on any webbrowser.

3.3 Algorithms

1. Accounts

Purpose : Toextractdataaboutuseraccountdetails

Input : accountsDatabase

Output : Listofname,type,passwordforuseraccounts

Algorithm :

Step1:Searchfortheaccountstablefromdatabase fileinthedump

Step2:Ifaccountstableisnotempty: Processaccounts

Queryname,type,passwordfrom accountstable

Add data to the respective columnsofreport Else: Noaccountsdatafound Step3:Generatereport

2. Call logs

Purpose : Toextractcalldata

Input : call_logsDatabase

Output : CallerID,ReceiverID,StartandEndtimestamp,call type

Algorithm :

Step 1 : Search for calls table in the call_logs database

Step2:Initializeemptylistsforincoming,outgoing, missedcalls.

ForensicToolGUI

TheproposedAndroidforensictoolshouldperform nondestructiveacquisitionfromrootedAndroiddevices. It isaGUIbasedtoolbasedonpythonlanguageandlibraries.It isproposedtoproduceresultsinthewebpages.Thedump filethatcontainstheentirefilesystemoftheandroiddevice hastobecreatedpriortothedataextractionandanalysis. TheGUIofthetoolexpectsaninputpathtothedumpfolder andanoutputpathforthestorageofgenerateddatareports. Further,theuserhastoselecttheartifactsfor whichdata should be processed allowing the user to customize the reportasperneed.Sincethedataisalreadyextractedinthe dumpfolder,theexecutionofthetoolisfastandthereport should be generated without much delay. The risky or potentiallyattackdataissegregatedfromthenormallegit

Step3:Ifcall_recordsnotempty: Iterateovercallrecords. case “Incoming”: Append the call detailstoincominglist case “Outgoing”: Append the call detailstooutgoinglist case “Missed”: Append the call detailstomissedcallslist

Step 4 : Add data to the respective columns of report

Step5:Generatereport

3. Messages (MMS SMS)

Purpose : Toextractmessagedatafromthedumpfile

Input : MMS SMS.dbDatabase

Output : Messagetimestamp,sender,receiver,content,type

Algorithm :

Step1:LookintoMMS SMSdatabase

Step 2 : Perform SQL operations(Perform Join operationtoextractdatafrommultiplerelated tablesandfilterthem)andqueriesontablesinthe abovedatabase

Step3:Generatereport

©
Journal | Page2101
2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

4. WhatsApp

Purpose : To extract data about WhatsApp application installedonthedevice

Input : wa.db,msgstore.db

Output : WhatsAppcontactsdata WhatsAppmessagedata

Algorithm :

Step1:SearchfortheWhatsAppdatabasefromthe dump

Step2:Ifdatabaseiswa.db: Query data from a table named wa_contacts.

Ifdatanotempty: Append data to WhatsAppcontactslist

Step3:Ifdatabaseismsgstore.db: Querydatafromatablenamed messages.

Ifdatanotempty: Appenddatato WhatsApp message data list

Step4:Adddatatotherespectivecolumnsofthe report.Generatereport.

5. Teams

Purpose : To perform forensics to get the data on Teams Application

Input : skype_teams.db

Output : Teams_messages, Teams_user, Teams_call logs, Teams_activity feed,Teams_file info

Algorithm :

Step1:Gettherequireddatabaseskype_teams.db

Step2:Ifskype_teams.dbnotempty: RetrieveTeams_messages, RetrieveTeams_user, RetrieveTeams_call logs, RetrieveTeams_activity feed, RetrieveTeams_file info

Step3:Generatereport

6. Chrome History

Purpose : ToextractchromehistoryfromAndroiddevice

Input : ChromeMediaHistoryfolder

Output : ID, URL, title, last_updated_time, watchtime, visit_count

Algorithm :

Step1:Checkbrowserdetails,OSanditstype.

Step 2 : Open files from the input folder namely origin,playback,playback_Session.

Step3:Retrievedataandmapvalueswithdefined attributekeys.

Step4:Generatereport.

3.4 Software Architecture

Component

Diagram

Deployment Diagram

©
Journal | Page2102
2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

OS Android7.1andhigher

InternalStorage 32GB SDCard 512MB 

1.

Software Requirements

ComputerSoftwareSpecifications

AndroidSDK AndroidStudio2020.3.1 IDE VSCode1.67.2

Language Python3.9.0

PythonLibraries PySimpleGUI4.16.0,MDB4.13

Database SQLite3.32.2

AndroidSDKPlatform tools ADB1.0.39,Emulator,DeviceFile Explorer

4. IMPLEMENTATION

4.1 Experimental Setup

Hardware Requirements

WeperformedtheforensicanalysisontheAndroid EmulatorofGooglePixel4.TheEmulatorandForensictool isruninacomputerhavingWindowsOS.

1. ComputerSpecifications

RAM 8GB(Min)

Processor Inteli58thgen,2.3GHz

OS Windows10,11

HardDisk 128GBSSD

USBPort USB3.0

2. MobileSpecifications

RAM 4GB(Min)

Processor Quadcoreprocessor,2.0GHz

CPU/ABI x86

Resolution 1080*2280:440dpi

CLI WindowsCommandPrompt Browser GoogleChrome,Firefox,Edge

2. MobileSoftwareSpecifications

AndroidAPILevel 25orhigher

Pre installedApplications Contacts, SMS, Calls, GooglePlay

Applications Installed Using GooglePlay Whatsapp,MSTeams

4.2 Environmental Setup

Create Android Emulator

Step1:IntheAndroidStudioMenubarnavigatetoTools > AVDManager

Step2:IntheVirtualDeviceManager,clickonCreateVirtual DeviceButton

Step3:IntheVirtualDeviceConfigurationWindow,Select theCategoryasPhoneandSelectthePixel4Phoneor any otherphonehavinggoogleplaysupportandclickNext.

Step4:SelectthesystemimageandclickNext.

2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal

Page2103
©
|
 Data Structure

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

Step5:GivenametotheAVD,Verifytheconfigurationsand clickonFinishbutton.

Step 6: We can see a new Emulator created in the AVD Manager. Run this Emulator by pressing Play Button in Actions

Install Required Packages For Forensic Tool

Step 1:NavigatetoprojectfolderintheCommandPrompt

Step 2: Install the requirements using the following command pip3 install -r requirements.txt 4.3 Android Forensics Tool Execution

Connect Android device to the computer

Step1:TurnontheAndroiddeviceor emulator.Connectthe mobiledevicetothecomputerusingUSBandturnonUSB debugginginthesettings.

Step3:GetthesuperuseraccesstotheAndroiddevicefrom thecomputer,runtheadbshellandentercommandsuand thenenterid.

Create the dump file

Step1:IntheAndroidStudioMenuBarnavigatetoView > ToolWindows >DeviceFileExplorer

Step 2: Check the connected Android devices to the computer by running the following adb command in the commandprompt adb devices

Step2:Selectthefoldersrequiredfordumpandsavethem byprovidingdumpfolderpath.Contentsofthedumpfolder areshowninnextscreenshot

Use Android Forensics Tool

Step 1: Open Command Prompt navigate to the forensic projectfolderandruntheforensictoolusingthefollowing command

© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page2104

International Research Journal of Engineering and Technology (IRJET)

e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

python .\forensicsTool.py

GUIwindowofAndroidForensicsToolopens

Forensic Tool GUI has four main components:

i)Inputpath:Tochooseinputdumpfolderpath

ii)Outputpath:Tochoosefoldertostoretheoutput/report oftheforensicanalysis

iii)ArtifactsList:Toselectamongtheartifactsavailablefor theforensics

iv)Executionlogdisplay:Toseethelogoftheprocessingof theforensicstool.

Step 2: Click on the Browse Folder button in Input Dump FolderandchoosetheDumpFolder.

Step4:Afterforensicanalysisprocessingiscompletedwe get the pop up window indicating processing complete messageandreportfilenameandpath.ClicktheOKbutton wecanseethereportinthebrowser.

Step 3: Select output folder to save the forensic analysis output:

5. RESULTS

We can view the report generated in any web browser window. Following screenshot shows the index pageofthereport.Reportisdividedindifferenttabsbased onartifactsandwecannavigatetoeachartifactreport by clickingontheartifactname.

1. Devicedetails

©
Journal | Page2105
2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified
e
09 Issue: 07 | July
p
© 2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal | Page2106 2. Contacts 3. Calllogs 4. GoogleChromeBrowserwebhistory 5. GoogleChromeSearchTerms 6. Notes 7. Messages 8. RecentTasks 9. WhatsappUserProfileDetails
International Research Journal of Engineering and Technology (IRJET)
ISSN: 2395 0056 Volume:
2022 www.irjet.net
ISSN: 2395 0072

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

MicrosoftTeamsAppMessages

6. CONCLUSION

The paper initially addresses the complete architecture of the mobile phones, with Android OS architecturebeingthelimelight.Thevulnerabilities,threats owingtohardwareandsoftwarearchitectureswerelooked upon. The Android security model was briefly discussed followed by mobile security w.r.t threats and attacks. The fewprominentmobileattackslikeimproperplatformusage, information gathering attack etc were also presented. Finally, a detailed discussion about the android forensics wasprovided.

Thefieldofmobileforensicsisboundtoattaingreat value as the ever precious data on smartphones are becomingatargetforcyberattacks.Thestudyincludesuse ofopensourceforensicsandanalysistools,frameworkssuch asAndroidDebugBridge,AndrillerTool,MobSF Tool, etc. Theirresultsaredocumentedasaguideforfurtherstudying andresearchpurposes.

Finally,anAndroidforensictoolforthepurposeof non destructive data acquisition software tool for rooted android devices was implemented and results were displayed. The tool was implemented with a user friendly GUI, that takes input an android dump file and an artifact checklistaspertheuserpreference.The extracteddata is furthercheckedforanymaliciousorpotentialattackdata. Thetoolgeneratestheresultasinteractive,wellformatted HTML based reports with classification of data as safe or risky, malicious. The reports can be viewed on any web browser.

7. REFERENCES

1. Sathe, Sneha C., and Nilima M. Dongre. "Data acquisition techniques in mobile forensics." 2018 2nd international conference on inventive systems and control (icisc).IEEE,2018.

2. Boueiz, Marie Rose. "Importance of rooting in an Android data acquisition." 2020 8th international

symposium on digital forensics and security (ISDFS).IEEE, 2020.

3. Almehmadi, Tahani, and Omar Batarfi. "Impact of androidphonerootingonuserdataintegrityinmobile forensics." 2019 2nd International Conference on Computer Applications & Information Security (ICCAIS). IEEE,2019.

4. Pan , Y., Ge, X., Fang, C., & Fan, Y. (2020) “A systematic literature review of android malware detectionusingstaticanalysis.” IEEE Access, 8,116363 116379.

5. Dar,MuneerAhmad."Anovelapproachtoenhance thesecurity

6. ofandroidbasedsmartphones." 2017 International Conference on Innovations in Information, Embedded and Communication Systems (ICIIECS). IEEE,2017.

7. Riadi, Imam. "Forensic Analysis of Android based InstantMessagingApplication." 2018 12th International Conference on Telecommunication Systems, Services, and Applications (TSSA).IEEE,2018.

8. Htun,NaingLinn,MieMieSuThwin,andChoCho San."EvidencedatacollectionwithANDROSICStoolfor androidforensics." 2018 10th International Conference on Information Technology and Electrical Engineering (ICITEE). IEEE,2018.

9. Hoog, Andrew. Android forensics: investigation, analysis and mobile security for Google Android. Elsevier, 2011.

10. Elenkov,Nikolay. Android security internals: An in depth guide to Android's security architecture. NoStarch Press,2014.

11. Dwivedi,Himanshu. Mobile application security. Tata McGraw Hill Education,2010.

8. BIOGRAPHIES

Kush Dabade, B.Tech Student, Dept. Of Computer Engineering and IT, VJTI College, Mumbai, Maharashtra

© 2022,
|
|
Certified Journal | Page2107
IRJET
Impact Factor value: 7.529
ISO 9001:2008
10.

International Research Journal of Engineering and Technology (IRJET) e ISSN: 2395 0056

Volume: 09 Issue: 07 | July 2022 www.irjet.net p ISSN: 2395 0072

Parijat Dhalkar, B.Tech Student, Dept. Of Computer Engineering and IT, VJTI College, Mumbai, Maharashtra

Siddhesh Bandgar, B.Tech Student, Dept. Of Computer Engineering and IT, VJTI College, Mumba,Maharashtra

Anshul Shende, B.Tech Student, Dept. Of Computer Engineering and IT, VJTI College, Mumbai, Maharashtra

2022, IRJET | Impact Factor value: 7.529 | ISO 9001:2008 Certified Journal

Page2108
©
|

Turn static files into dynamic content formats.

Create a flipbook