Live memory forensics of mobile phones

Mobile Phone used not to be matter of luxury only, it has become a significant need for rapidly evolving fast track world. This paper proposes a spatial context recognition system in which certain types of human physical activities using accelerometer and gyroscope data generated by a mobile device focuses on reducing processing time. The benchmark Human Activity Recognition dataset is considered for this work is acquired from UCI Machine Learning Repository, which is available in public domain. Our experiment shows that Principal Component Analysis used for dimensionality reduction brings 70 principal components from 561 features of raw data while maintaining the most discriminative information. Multi Layer Perceptron Classifier was tested on principal components. We found that the Multi Layer Perceptron reaches an overall accuracy of 96.17 % with 70 principal components compared to 98.11 % with 561 features reducing time taken to build a model from 658.53 s to 128.00 s.

PCA Based Optimal ANN Classifiers for Human Activity Recognition Using Mobile Sensors Data

This paper introduces a method for acquiring forensic-grade evidence from Android smartphones using open source tools. We investigate in particular cases where the suspect has made use of the smartphone's Wi-Fi or Bluetooth interfaces. We discuss the forensic analysis of four case studies, which revealed traces that were left in the inner structure of three mobile Android devices and also indicated security vulnerabilities. Subsequently, we propose a detailed plan for forensic examiners to follow when dealing with investigations of potential crimes committed using the wireless facilities of a suspect Android smartphone. This method can be followed to perform physical acquisition of data without using commercial tools and then to examine them safely in order to discover any activity associated with wireless communications. We evaluate our method using the Association of Chief Police Officers' (ACPO) guidelines of good practice for computer-based, electronic evidence and demonstrate that it is made up of an acceptable host of procedures for mobile forensic analysis, focused specifically on device Bluetooth and Wi-Fi facilities.

Forensic analysis of wireless networking evidence of Android smartphones

With the rapid development of technology, mobile phones have become an essential tool in terms of crime fighting and criminal investigation. However, many mobile forensics investigators face difficulties with the investigation process in their domain. These difficulties are due to the heavy reliance of the forensics field on knowledge which, although a valuable resource, is scattered and widely dispersed. The wide dispersion of mobile forensics knowledge not only makes investigation difficult for new investigators, resulting in substantial waste of time, but also leads to ambiguity in the concepts and terminologies of the mobile forensics domain. This paper developed an approach for mobile forensics domain based on metamodeling. The developed approach contributes to identify common concepts of mobile forensics through a development of the Mobile Forensics Metamodel (MFM). In addion, it contributes to simplifying the investigation process and enables investigation teams to capture and reuse specialized forensic knowledge, thereby supporting the training and knowledge management activities. Furthermore, it reduces the difficulty and ambiguity in the mobile forensics domain. A validation process was performed to ensure the completeness and correctness of the MFM. The validation was conducted using two techniques for improvements and adjustments to the metamodel. The last version of the adjusted metamodel was named MFM 1.2.

/pdf/a-metamodel-for-mobile-forensics-investigation-domain-1zfvl0xy7i.pdf

A metamodel for mobile forensics investigation domain.

GPS-enabled mobile devices such as smart phones and tablets are extremely popular today. Billions of such devices are currently in use. The application and research potentials of these devices are limitless, but how accurate are these devices? The research team used Average Euclidean Error (AEE), Root Mean Square Error (RMSE), and Central Error (CE) to define and calculate the accuracy and precision of six popular GPS-enabled mobile devices running on two different operating systems (Android and iOS) from measurements in Clarksville, Tennessee, USA. Spatial data (multiple measurements) consisting of latitude and longitude coordinates of positions reported by these six GPS-enabled mobile devices were collected at nine different physical locations (control points). The results of the field data were ranked and compared through the use of one scientific and two realistic measuring protocols. The scientific protocol was designed to simulate standard scientific experimental practices (a controlled experiment). The realistic protocols were designed to simulate daily usage of mobile devices (holding a mobile phone at around waist level). In this preliminary study, it was discovered that various mobile devices perform differently in terms of AEE, RMSE, and CE. It also showed that the protocol is not a statistically significant contributing factor to the variation in the measurements in terms of accuracy nor precision. The device and the location are statistically significant contributing factors to the variation in the measurements in terms of accuracy and precision. The interaction between protocol and device is not a statistically significant contributing factor. It is also discovered that the devices are statistically less accurate than they are precise.

Comparison of Accuracy and Precision of GPS-Enabled Mobile Devices

Mobile Forensics: An Overview, Tools, Future Trends and Challenges from Law Enforcement Perspective

represent a serious security threat on the Internet. Current security mechanism are typically inadequate for protecting against the latest breed of botnets, as botherders constantly develop new techniques and methods to frustrate investigators. Until recently, mobile networks have been relatively isolated from the Internet, so there has been little need for protecting against botnets. However, this situation is rapidly changing. With the rapid development of the computing and Internet access (i.e., using WiFi, GPRS and 3G) capabilities of smartphones, constructing practical mobile botnets has become an underlying trend. Thus, threats on the Internet most likely will migrate over to the mobile networks and vice versa. Botnets of malware injected into mobile devices will probably appear very soon, and there are already signs of this happening. This paper analyses the potential threat of botnets based on mobile networks. The study done will be further utilized for improving the performance of the developed "Efficient Generalized Forensics Framework for Mobile Devices". To conclude our paper, we suggest possible defenses against the emerging threat.

/pdf/study-of-mobile-botnets-an-analysis-from-the-perspective-of-2y235dkuup.pdf

Study of Mobile Botnets: An Analysis from the Perspective of Efficient Generalized Forensics Framework for Mobile Devices

Mobile phone proliferation in our societies is on the increase. Advances in semiconductor technologies related to mobile phones and the increase of computing power of mobile phones led to an increase of functionality of mobile phones while keeping the size of such devices small enough to fit in a pocket. This led mobile phones to become portable data carriers. This in turn increased the potential for data stored on mobile phone handsets to be used as evidence in civil or criminal cases. This paper examines the nature of some of the newer pieces of information that can become potential evidence on mobile phones. It also highlights some of the weaknesses of mobile forensic toolkits and procedures. Finally, the paper shows the need for more in depth examination of mobile phone evidence.

Mobile Forensics: An Introduction from Indian Law Enforcement Perspective

From student to business worker, the popularity and ubiquity of mobile devices is exploding. As these devices saturate modern culture, they continue to grow in functionality. Acquiring information from a mobile phone is now an important issue in many criminal investigations. Mobile phones can contain large amounts of information which can be of use in an investigation. These include typical mobile device data including SMS, phone records, images, audio, video, calendar and diary entries. As the difference between a PDA and a mobile phone is now blurred, the data that can reside on a mobile phone is somewhat endless.In this paper, we try to identify factors that pose as major roadblocks for mobile forensics and describes techniques to address two resulting problems in particular: the limited coverage of available phone models by forensic tools, and the inadequate means for validating the correct functioning of forensic tools

/pdf/mobile-forensics-the-roadblocks-ahead-proposed-solutions-1wxagm8q3t.pdf

Rizwan Ahmed

Papers

Mobile Forensics: An Overview, Tools, Future Trends and Challenges from Law Enforcement Perspective

Study of Mobile Botnets: An Analysis from the Perspective of Efficient Generalized Forensics Framework for Mobile Devices

Mobile Forensics: An Introduction from Indian Law Enforcement Perspective

Mobile Forensics: the roadblocks ahead, proposed solutions using Protocol Filtering and SIM programming