Methodology for Forensics Data Reconstruction on Mobile Devices with Android Operating System Applying In-System Programming and Combination Firmware

This paper proposes a new forensic analysis methodology that combines processes, techniques, and tools for physical and logical data acquisition from mobile devices. The proposed methodology allows an overview of the use of the In-System Programming (ISP) technique with the usage of Combination Firm...

Full description

Saved in:
Bibliographic Details
Published in:Applied sciences 2020-06, Vol.10 (12), p.4231
Main Authors: da Silveira, Claudinei Morin, T. de Sousa Jr, Rafael, de Oliveira Albuquerque, Robson, Amvame Nze, Georges D., de Oliveira Júnior, Gildásio Antonio, Sandoval Orozco, Ana Lucila, García Villalba, Luis Javier
Format: Article
Language:English
Subjects:
android data extraction
Automobile safety
Combination Firmware
Computer forensics
Criminal investigations
Data acquisition
Data recovery
Evidence
Firmware
Forensic science
Forensic sciences
In-System Programming
Investigations
Methodology
Methods
Microcode
Mobile Device Forensics
Mobile devices
Mobile operating systems
Operating systems
physical/logical data acquisition
Preservation
Smartphones
Software
Systems programming (Computer science)
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:This paper proposes a new forensic analysis methodology that combines processes, techniques, and tools for physical and logical data acquisition from mobile devices. The proposed methodology allows an overview of the use of the In-System Programming (ISP) technique with the usage of Combination Firmware, aligned with specific collection and analysis processes. The carried out experiments show that the proposed methodology is convenient and practical and provides new possibilities for data acquisition on devices that run the Android Operating System with advanced protection mechanisms. The methodology is also feasible in devices compatible with the usage of Joint Test Action Group (JTAG) techniques and which use Embedded Multimedia Card (eMMC) or Embedded Multi-Chip Package (eMCP) as main memory. The techniques included in the methodology are effective on encrypted devices, in which the JTAG and Chip-Off techniques prove to be ineffective, especially on those that have an unauthorized access protection mechanism enabled, such as lock screen password, blocked bootloader, and Factory Reset Protection (FRP) active. Studies also demonstrate that data preservation and integrity are maintained, which is critical to a digital forensic process.
ISSN:2076-3417
2076-3417
DOI:10.3390/app10124231