IT Forensics
Mobile Forensics
Smartphones are now virtually on par with full-fledged computers. The amount of digital evidence relevant to IT forensics on smartphones is growing. When an IT forensic investigator searches for evidence on a smartphone, they are initially faced with a vast amount of data. Without knowing where specific traces are left, the search for evidence is futile.
In practice, knowledge about digital traces is usually gathered through exploratory methods; that is, investigators search promising locations for information that can be linked to specific actions. However, an investigator can never be certain that they are aware of all the places where certain actions leave traces. Given the short product cycles for smartphones, it is difficult for IT forensic analysts to keep up with the latest developments. This is particularly true for the Android operating system, where between 2 and 4 new versions have been released annually in recent years. With this pace of development, training materials for IT forensic investigators are outdated before they are even published. On the other hand, IT forensic investigators need ways to locate the relevant memory locations where traces are created when necessary.
What traces are you looking for, and where?
To ensure comprehensive evidence preservation on Android smartphones, Fraunhofer SIT has developed a solution that automatically and systematically identifies all relevant locations of traces. To do this, the complete state of a system is captured at various points in time, and changes to the system are assigned to the actions that occurred between those points. This enables an IT forensic investigator to test hypotheses regarding the perpetrator’s activities. Using the Fraunhofer SIT solution, the IT forensic analyst is able to identify which user activities cause which data changes in memory. With this knowledge, they can then verify whether the device under analysis contains traces resulting from a suspected perpetrator’s activity. The systematic approach of Fraunhofer SIT ensures that no traces associated with a specific action are overlooked.
