Android Mobile Forensics with Parallel File Carving and Machine Learning-Based Analysis
摘要
A recent trend has been an increase in mobile device usage for criminal activity. Therefore, it is essential to have methods to recover data from mobile devices. However, modern mobile devices are becoming increasingly difficult to access due to File Based Encryption (FBE), which limits what can be recovered by traditional forensic tools. In addition to FBE, many mobile devices also have Full Disk Encryption (FDE). These two technologies are causing significant issues for Digital Forensic Investigators (DFIs) who need to recover information from devices that are encrypted. This study proposes a full forensic process that utilizes parallel recovery techniques and automatic analysis features to address the shortcomings of accessible mobile devices for recovery. The proposed forensic method will integrate complementary file recovery tools (PhotoRec and Foremost) into a synchronized parallel execution model, thereby optimizing recovery ratios and decreasing processing times. Additionally, our proposed forensic process will use intelligent techniques to consolidate, eliminate duplicates, and reconstruct metadata to improve the overall recovery quality of the process. Finally, our proposed forensic process will incorporate several advanced analytical modules such as metadata extraction, error level analysis (ELA) for identifying manipulated images, facial recognition via convolutional neural networks (CNNs), object identification utilizing YOLO architecture, and automatic content recognition. The experimental results will demonstrate how our proposed forensic process outperforms individual tool processes, achieving a maximum of 100% recovery rates on unencrypted and accessible devices with improved quality and forensic value of outputs.