Android Encryption Database Forensic Analysis Based on Static Analysis
Zhang Yu, Binglong Li, Yi-Feng Sun · Proceedings of the 4th International Conference on Computer Science and Application Engineering · 2020
Forensic analysis of mobile applications plays a crucial part in gathering evidence against criminals. Because the evidence data obtained may often be stored in an encrypted local database or is itself encrypted, the forensic analysis of encrypted databases in smartphones is a critical process in digital crime forensics investigation. However, most of the forensic research on databases currently focuses on specific mobile applications. Moreover, it is difficult to automate dynamic analysis because an appropriate runtime environment must be set up to meet the needs of forensic investigation. This paper proposes a method for mobile database encryption forensics investigation in Android smartphones based on static analysis, which is not limited to a specific mobile application and features automated analytics. The method uses the installation package of the Android application to perform reverse analysis, constructs an inter-program control flow chart, and builds a data flow graph based on the control flow graph. Based on this graph, the database encryption method is searched and identified. We also implement a system to automate the analysis of Android encrypted data. Our method overcomes the challenges of static analysis by using a self-made probability model and proposes a specifically devised algorithm to search the database encryption method on the control flow chart and data flow chart. Finally, we select 100 Android applications to verify our method to analyze the encrypted data stored in the database. The analysis of all applications is completed in 39.6 h. Our experimental results show that the proposed method could find 705 encrypted databases in the 100 apps. In addition, our method successfully determines the encryption method of 584 databases with an accuracy of 82.9% and realizes the decryption of these databases.