Skip to main content
Springer Nature Link
Log in

Mobile forensic reference set (MFReS) and mobile forensic investigation for android devices

  • Published:
The Journal of Supercomputing Aims and scope Submit manuscript

Abstract

This paper proposes the mobile forensic reference set (MFReS), a mobile forensic investigation procedure and a tool for mobile forensics that we developed. The MFReS consists of repositories, databases, and services that can easily retrieve data from a database, which can be used to effectively classify meaningful data related to crime, among numerous data types in mobile devices. Mobile data consist of system data, application data, and multimedia data according to characteristics and format. We have developed a mobile forensic process that can effectively analyze information from installed applications and user behavior through these data. In particular, our tool can be useful for investigators because it can analyze the log files of all applications (apps) and analyze behavior based on timeline, geodata, and other characteristics. Our research can contribute to the study of mobile forensic support systems and suggest the direction of mobile data analysis tool development.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6

Similar content being viewed by others

References

  1. ISO/IEC 27043 (2015) Information technology: security techniques: incident investigation principles and processes

  2. Raymond EM, Venter HS (2014) Mobile forensics using the harmonised digital forensic investigation process. In: 2014 Information security for South Africa. IEEE

  3. Omeleze S, Venter HS (2013) Testing the harmonised digital forensic investigation process model-using an Android mobile phone. In: 2013 Information security for South Africa. IEEE

  4. NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics (2014)

  5. NIST NSRL (2016). http://www.nsrl.nist.gov/

  6. Mead S (2006) Unique file identification in the national software reference library. Digit Investig 3:138–150

    Article  Google Scholar 

  7. Kim K, Park S, Chang T, Lee C, Back S (2009) Lessons learned from the construction of a Korean software reference data set for digital forensics. Digit Investig 6:S108–113

    Article  Google Scholar 

  8. Ruback Marcelo, Hoel Bruno, Ralha Celia (2012) A new approach for creating forensic hashsets. In: Advances in digital forensics VIII: IFIP AICT, vol 383 pp 83–97

    Google Scholar 

  9. Rowe NC (2012) Testing the national software reference library. Digit Investig 9:S131–138

    Article  Google Scholar 

  10. Telegram (2016). https://telegram.org/

  11. KakaoTalk (2016). http://www.kakao.com/talk/

  12. ApkTool (2016). https://ibotpeaches.github.io/Apktool/

  13. dex2jar (2016). http://sourceforge.net/projects/dex2jar/

  14. JD Project (2016). http://jd.benow.ca/

  15. JEB Decompiler (2016). https://www.pnfsoftware.com/

  16. Ohana DJ, Shashidhar N (2013) Do private and portable web browsers leave incriminating evidence?: a forensic analysis of residual artifacts from private and portable web browsing sessions. EURASIP J Inf Secur

  17. Lukas J, Fridrich J, Goljan M (2006) Digital camera identification from sensor pattern noise. IEEE Trans Inf Forensics Secur 1(2):205–214

    Article  Google Scholar 

  18. Kornblum JD (2008) Using JPEG quantization tables to identify imagery processed by software. Digit Investig 5:S21–S25

    Article  Google Scholar 

  19. Thai TH, Retraint F, Cogranne R (2016) Camera model identification based on the generalized noise model in natural images. Digit Signal Process 48:285–297

    Article  MathSciNet  Google Scholar 

  20. Kim MS, Jung D, Lee S (2016) Building a database of DQT information to identify a source of the smartphone JPEG image file. Korea Inst Inf Secur Cryptol 26(2):359–367

    Article  Google Scholar 

  21. The Sleuth Kit (TSK) & Autopsy (2016) Open source digital forensics tools. http://www.sleuthkit.org/

  22. md5deep and hashdeep (2016). http://md5deep.sourceforge.net/#download/

  23. Blondel VD, Decuyper A, Krings G (2015) A survey of results on mobile phone datasets analysis. EPJ Data Sci

  24. Choi J, Lee S (2016) A study of user relationships in smartphone forensics. Multimed Tools Appl 75:14971–14983

    Article  Google Scholar 

  25. NIST Computer Forensics Tool Testing Program (2016). http://www.cftt.nist.gov/

  26. Talib A (2016) Towards early software reliability prediction for computer forensic tools (case study). Springerplus

Download references

Acknowledgements

This research was supported by the Public Welfare and Safety Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Science, ICT and Future Planning (2012M3A2A1051106).

Author information

Authors and Affiliations

  1. Digital Forensic Research Center (DFRC), Korea University, Seoul, South Korea

    Dohyun Kim, Yunho Lee & Sangjin Lee

Authors
  1. Dohyun Kim
    View author publications

    You can also search for this author inPubMed Google Scholar

  2. Yunho Lee
    View author publications

    You can also search for this author inPubMed Google Scholar

  3. Sangjin Lee
    View author publications

    You can also search for this author inPubMed Google Scholar

Corresponding author

Correspondence to Sangjin Lee.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Kim, D., Lee, Y. & Lee, S. Mobile forensic reference set (MFReS) and mobile forensic investigation for android devices. J Supercomput 74, 6618–6632 (2018). https://doi.org/10.1007/s11227-017-2205-5

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11227-017-2205-5

Keywords