Android Forensics Using Sleuth Kit Autopsy

Abstract

Mobile device forensics has gained significance with the increase in the user base and the proliferation of smartphones. The digital shreds of evidence extracted from these devices may lead a forensic investigation to confidence. In this literature, we experimented with the Android Forensics process and have tried to explain the whole process in a detailed manner. We demonstrated the whole Android Forensics process in two stages. In the data acquisition stage, we have shown how we extracted the raw image of each memory location of the memory device from the android device and save it to a file with .dd extension. In order to achieve this imaging capability, we have also demonstrated the need for root access to the android file system along with the understanding of the android file system. Then in the second stage, called the artifact finding stage, we demonstrate the process of loading the raw disk image acquired by us in the data acquisition stage and analyzing it using the Sleuth Kit Autopsy tool to uncover the artifacts from the analysis of the raw data. We have demonstrated the usefulness of Sleuth Kit Autopsy which is an open-source forensic tool. We have recorded the level of detail about artifacts that are obtained using the Sleuth Kit Autopsy during our experiment. The report generated and the artifacts uncovered using Sleuth Kit Autopsy can be linked logically with a crime scene and may help lead a digital forensic investigation to confidence. The insight gained from this work is highly extensible in nature.