Using a face validity approach, this paper provides a validation of the Database Forensic Investigation Metamodel (DBFIM). The DBFIM was developed to solve interoperability, heterogeneity, complexity, and ambiguity in the database forensic investigation (DBFI) field, where several models were identified, collected, and reviewed to develop DBFIM. However, the developed DBFIM lacked the face validity-based approach that could ensure DBFIM’s applicability in the DBFI field. The completeness, usefulness, and logic of the developed DBFIM needed to be validated by experts. Therefore, the objective of this paper is to perform the validation of the developed DBFIM using the qualitative face validity approach. The face validity method is a common way of validating metamodels through subject expert inquiry on the domain application of the metamodel to assess whether the metamodel is reasonable and compatible based on the outcomes. For this purpose, six experts were nominated and selected to validate the developed DBFIM. From the expert review, the developed DBFIM was found to be complete, coherent, logical, scalable, interoperable, and useful for the DBFI field.

https://www.mdpi.com/2412-3811/6/2/13/pdf

Face Validation of Database Forensic Investigation Metamodel

Forensic analysis of instant messengers: Decrypt Signal, Wickr, and Threema

Interpol review of digital evidence for 2019–2022

Forensic analysis of mobile applications plays a crucial part in gathering evidence against criminals. Because the evidence data obtained may often be stored in an encrypted local database or is itself encrypted, the forensic analysis of encrypted databases in smartphones is a critical process in digital crime forensics investigation. However, most of the forensic research on databases currently focuses on specific mobile applications. Moreover, it is difficult to automate dynamic analysis because an appropriate runtime environment must be set up to meet the needs of forensic investigation. This paper proposes a method for mobile database encryption forensics investigation in Android smartphones based on static analysis, which is not limited to a specific mobile application and features automated analytics. The method uses the installation package of the Android application to perform reverse analysis, constructs an inter-program control flow chart, and builds a data flow graph based on the control flow graph. Based on this graph, the database encryption method is searched and identified. We also implement a system to automate the analysis of Android encrypted data. Our method overcomes the challenges of static analysis by using a self-made probability model and proposes a specifically devised algorithm to search the database encryption method on the control flow chart and data flow chart. Finally, we select 100 Android applications to verify our method to analyze the encrypted data stored in the database. The analysis of all applications is completed in 39.6 h. Our experimental results show that the proposed method could find 705 encrypted databases in the 100 apps. In addition, our method successfully determines the encryption method of 584 databases with an accuracy of 82.9% and realizes the decryption of these databases.

Zhang Yu

Papers

Android Encryption Database Forensic Analysis Based on Static Analysis