You can run but you cannot hide from memory: Extracting im evidence of Android apps

Authors: Nisioti, A., Mylonas, A., Katos, V., Yoo, P.D. and Chryssanthou, A.

Journal: 2017 IEEE Symposium on Computers and Communications (ISCC)

Pages: 457-464

DOI: 10.1109/ISCC.2017.8024571

This source preferred by Antonia Nisioti, Alexios Mylonas and Vasilis Katos

This data was imported from Scopus:

Authors: Nisioti, A., Mylonas, A., Katos, V., Yoo, P.D. and Chryssanthou, A.

Journal: Proceedings - IEEE Symposium on Computers and Communications

Pages: 457-464

ISBN: 9781538616291

ISSN: 1530-1346

DOI: 10.1109/ISCC.2017.8024571

© 2017 IEEE. Smartphones have become a vital part of our business and everyday life, as they constitute the primary communication vector. Android dominates the smartphone market (86.2%) and has become pervasive, running in 'smart' devices such as tablets, TV, watches, etc. Nowadays, instant messaging applications have become popular amongst smartphone users and since 2016 are the main way of messaging communication. Consequently, their inclusion in any forensics analysis is necessary as they constitute a source of valuable data, which might be used as (admissible) evidence. Often, their examination involves the extraction and analysis of the applications' databases that reside in the device's internal or external memory. The downfall of this method is the fact that databases can be tampered or erased, therefore the evidence might be accidentally or maliciously modified. In this paper, a methodology for retrieving instant messaging data from the volatile memory of Android smartphones is proposed, instead of the traditional database retrieval. The methodology is demonstrated with the use of a case study of four experiments, which provide insights regarding the behavior of such data in memory. Our experimental results show that a large amount of data can be retrieved from the memory, even if the device's battery is removed for a short time. In addition, the retrieved data are not only recent messages, but also messages sent a few months before data acquisition.

The data on this page was last updated at 04:45 on January 16, 2018.