%0 Journal Article %1 alsabaawi2019comparison %A AL-Sabaawi, Aiman %A Foo, Ernest %D 2019 %E Editor, %J International Journal of Computer Science and Security (IJCSS) %K Android Digital Forensics, Mobile Security %N 4 %P 148 - 166 %T A Comparison Study of Android Mobile Forensics for Retrieving Files System %U http://www.cscjournals.org/library/manuscriptinfo.php?mc=IJCSS-1496 %V 13 %X A comparison study of the Android forensic field in terms of Android forensic process for acquiring and analysing an Android disk image is presented. The challenges of Android forensics, including the complexity of the Android application, different procedures and tools for obtaining data, difficulties with hardware set up, using expensive commercial tools for acquiring logical data that fail to retrieve physical data acquisition are described in this paper. To solve these challenges and achieve high accuracy and integrity in Android forensic processes, a new open source technique is investigated. Manual, Logical and physical acquisition techniques are used to acquire data from an Android mobile device (Samsung Android 4.2.2). The mobile phone is identified by taking photos of the device and its individual components, including the memory expansion card, and labelling them with identifying information. Following the manual acquisition, logical acquisition is conducted using the AFLogical application in the ViaExtract tool (by Now secure) installed on a Santoku Linux Virtual Machine. The image file is then created using the AccessData FTK imager tool for physical acquisition. Four tools are utilized to analyse recovered data: one using ViaExtract on a Santoku Linux Virtual Machine, two using the AccessData FTK Imager, and one using file carving in Autopsy on a Kali Linux Virtual Machine. The results of the analysis demonstrate that the technique can retrieve Contacts, photos, Videos, Call Logs, and SMSs. Also, the EaseUS Data Recovery Wizard Free tool is used for the recovery of files from the LOST.DIRon external memory.

@article{alsabaawi2019comparison, abstract = {A comparison study of the Android forensic field in terms of Android forensic process for acquiring and analysing an Android disk image is presented. The challenges of Android forensics, including the complexity of the Android application, different procedures and tools for obtaining data, difficulties with hardware set up, using expensive commercial tools for acquiring logical data that fail to retrieve physical data acquisition are described in this paper. To solve these challenges and achieve high accuracy and integrity in Android forensic processes, a new open source technique is investigated. Manual, Logical and physical acquisition techniques are used to acquire data from an Android mobile device (Samsung Android 4.2.2). The mobile phone is identified by taking photos of the device and its individual components, including the memory expansion card, and labelling them with identifying information. Following the manual acquisition, logical acquisition is conducted using the AFLogical application in the ViaExtract tool (by Now secure) installed on a Santoku Linux Virtual Machine. The image file is then created using the AccessData FTK imager tool for physical acquisition. Four tools are utilized to analyse recovered data: one using ViaExtract on a Santoku Linux Virtual Machine, two using the AccessData FTK Imager, and one using file carving in Autopsy on a Kali Linux Virtual Machine. The results of the analysis demonstrate that the technique can retrieve Contacts, photos, Videos, Call Logs, and SMSs. Also, the EaseUS Data Recovery Wizard Free tool is used for the recovery of files from the LOST.DIRon external memory.}, added-at = {2020-02-03T12:49:12.000+0100}, author = {AL-Sabaawi, Aiman and Foo, Ernest}, biburl = {https://www.bibsonomy.org/bibtex/25dce8860290e8742b56f851ae690879c/cscjournals}, editor = {Editor}, interhash = {aa231dfbb1cd56f550f720637186cea1}, intrahash = {5dce8860290e8742b56f851ae690879c}, issn = {1985-1553}, journal = {International Journal of Computer Science and Security (IJCSS)}, keywords = {Android Digital Forensics, Mobile Security}, language = {English}, month = {August}, number = 4, pages = {148 - 166}, timestamp = {2020-02-03T12:49:12.000+0100}, title = {A Comparison Study of Android Mobile Forensics for Retrieving Files System}, url = {http://www.cscjournals.org/library/manuscriptinfo.php?mc=IJCSS-1496}, volume = 13, year = 2019 }