Comprehensive Evaluation of Smartphone Local Backup for Forensic Data Acquisition

Основні поняття

Local backup mechanisms offered by mobile operating systems can be used as a generic way to access data on smartphones, but their suitability and reliability for forensic data acquisition have not been systematically evaluated.

Анотація

The authors conducted a thorough evaluation of the local backup mechanisms provided by iOS and Android to assess their suitability for forensic data acquisition. They developed a generic evaluation procedure that compares the contents of local backups to the original storage on the devices.

For Android, the evaluation included both full backups and selective backups using app-downgrading. The results showed that in most cases, the acquired data from the local backup was correct and matched the original data on the device. However, some corner cases were identified, such as database files with pending changes, where the backup data did not fully match the original.

For iOS, the evaluation included both encrypted and unencrypted local backups. The results were similar to Android, with most of the data being correctly acquired. However, the authors found that over 10% of the data, particularly database files, showed alterations compared to the original data due to the merging of uncommitted changes during the backup process.

The authors conclude that local backup can be a suitable method for forensic data acquisition, but certain limitations and corner cases need to be considered when assessing the integrity and authenticity of the evidence.

Статистика

The SMS backup file contains information about the user's SMS messages, including the address, body, date, date_sent, read, status, and type.
The call log backup file contains information about the user's call history, including the _id, number, presentation, date, duration, type, subscription_component_name, subscription_id, phone_account_address, and block_reason.
The settings backup file contains a subset of device settings from various configuration files, including settings_config.xml, settings_global.xml, settings_secure.xml, WifiConfigStore.xml, and WifiConfigStoreSoftAp.xml.

Цитати

None.

Ключові висновки, отримані з

Systematic Evaluation of Forensic Data Acquisition using Smartphone Local Backup

by Julian Geus,... о arxiv.org 04-22-2024

https://arxiv.org/pdf/2404.12808.pdf

Глибші Запити

How would the results of this evaluation change if the devices were running different versions of the operating systems or if the backup process was performed under different environmental conditions

The results of the evaluation could potentially change if the devices were running different versions of the operating systems or if the backup process was performed under different environmental conditions.

Different OS Versions:

Newer versions of the operating systems may introduce changes in the way data is stored, accessed, or backed up. This could impact the reliability and accuracy of the backup process. For example, new security features or encryption methods in the OS could affect the ability to access certain types of data or the integrity of the backup.
Changes in the file structure, file naming conventions, or data storage locations between OS versions could lead to discrepancies in the backup process. This could result in missing data, altered data, or difficulties in mapping backup data to its original location on the device.

Environmental Conditions:

Variations in environmental conditions during the backup process, such as network connectivity, device settings, or background processes, could influence the quality of the backup data.
Factors like network interruptions, device performance issues, or concurrent activities on the device could impact the completeness and accuracy of the backup. These conditions could introduce errors, data corruption, or missing data in the backup.
In summary, different OS versions and environmental conditions can introduce variables that may affect the reliability and integrity of the data acquisition process through local backups. It is essential to consider these factors when evaluating forensic data acquisition methods on smartphones.

What other types of data, beyond the ones evaluated in this study, could be acquired through local backups, and how would their reliability and integrity need to be assessed

Beyond the data types evaluated in this study, local backups could potentially acquire a wide range of data from smartphones. Some additional types of data that could be obtained through local backups include:

App Data: Besides the apps evaluated in the study, other applications on the device may store sensitive data that could be included in the backup. This could include messaging apps, social media apps, productivity tools, and more.
Device Settings: Backup mechanisms often include device settings, system configurations, and preferences. These settings can provide valuable information about the user's behavior, usage patterns, and device interactions.
Media Files: Photos, videos, audio recordings, and other media stored on the device could be part of the backup. These files may contain metadata, timestamps, and geolocation information that could be relevant for forensic analysis.
Browser History and Bookmarks: Information about the user's browsing history, saved passwords, and bookmarked sites from the device's browser could be included in the backup. This data could reveal user activities, interests, and online behavior.
When assessing the reliability and integrity of these additional data types acquired through local backups, it is essential to:

Verify the completeness of the backup by comparing it to the original data on the device.
Check for any discrepancies, alterations, or missing data during the backup process.
Validate the accuracy and consistency of the acquired data through thorough analysis and comparison with reference data.
Consider the potential impact of different OS versions, environmental conditions, and backup methods on the acquired data.

Given the limitations identified in this study, what alternative methods or approaches could be explored to improve the forensic soundness of data acquisition from smartphones

Given the limitations identified in the study, several alternative methods or approaches could be explored to enhance the forensic soundness of data acquisition from smartphones:

Physical Acquisition: Conducting a physical acquisition of the device's storage using specialized tools and techniques can provide a bit-by-bit copy of the device's data, ensuring a comprehensive and forensically sound acquisition.
Live Data Acquisition: Performing live data acquisition on the device while it is operational can capture volatile data, active processes, and real-time information that may not be available through traditional backup methods.
Memory Forensics: Utilizing memory forensics techniques to extract data from the device's RAM can uncover valuable information such as running processes, encryption keys, and user activities that may not be accessible through standard backups.
Cloud Forensics: Extending the investigation to include analysis of cloud storage, synchronization services, and online accounts linked to the device can provide a more complete picture of the user's digital footprint and activities.
Blockchain Analysis: Exploring blockchain technology and cryptocurrency transactions on the device can uncover additional evidence related to financial transactions, digital assets, and decentralized applications.
By incorporating these alternative methods and approaches into the forensic data acquisition process, investigators can enhance the depth, accuracy, and reliability of the evidence obtained from smartphones.