Comparison of Open Source Android Forensic Toolkits and Methodologies in Data Acquisition
Ali Shadzik, Pardeep Jasra, Shashi Kiran Jasra · 2016
Methodologies and techniques in mobile forensic data acquisition are compared with regards to various toolkits, data carving, and analysis software available in CAINE (Computer Aided Investigative Environment) and Santoku forensic Linux distributions. Comparison is made between these open-source methods of data recovery versus the use of the preconfigured and commercially available Cellebrite® Universal Forensic Extraction Device. The results were analyzed quantitatively and qualitatively for their relevance. The quantitative comparison took into consideration the raw size of the data recovered through physical acquisition versus the size of data accessible through logical acquisition. The qualitative analysis was based on the forensically prudent nature of the data. The results concluded that the best toolkit for overall quality of data was Autopsy Sleuth Kit. The largest quantity of data acquired from the four test devices was obtained from Bulk Extractor. Ultimately, open source forensic toolkits are a reliable and cost effective alternative to commercial products with respect to acquiring, analyzing, and presenting evidence obtained from an electronic search and seizure.