Forensic Taxonomy of Android Social Apps

Abdullah Azfar; Kim-Kwang Raymond Choo; Lin Liu

doi:10.1111/1556-4029.13267

Forensic Taxonomy of Android Social Apps

J Forensic Sci. 2017 Mar;62(2):435-456. doi: 10.1111/1556-4029.13267. Epub 2016 Nov 28.

Authors

Abdullah Azfar¹, Kim-Kwang Raymond Choo^{1

2}, Lin Liu³

Affiliations

¹ Information Assurance Research Group, University of South Australia, Adelaide, SA, 5095, Australia.
² Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, 78249-0631, USA.
³ School of Information Technology and Mathematical Sciences, University of South Australia, Adelaide, SA, 5095, Australia.

PMID: 27892599
DOI: 10.1111/1556-4029.13267

Abstract

An Android social app taxonomy incorporating artifacts that are of forensic interest will enable users and forensic investigators to identify the personally identifiable information (PII) stored by the apps. In this study, 30 popular Android social apps were examined. Artifacts of forensic interest (e.g., contacts lists, chronology of messages, and timestamp of an added contact) were recovered. In addition, images were located, and Facebook token strings used to tie account identities and gain access to information entered into Facebook by a user were identified. Based on the findings, a two-dimensional taxonomy of the forensic artifacts of the social apps is proposed. A comparative summary of existing forensic taxonomies of different categories of Android apps, designed to facilitate timely collection and analysis of evidentiary materials from Android devices, is presented.

Keywords: digital forensics; forensic science; forensic taxonomy; mobile app forensics; mobile forensics; social app taxonomy.