Change search
ReferencesLink to record
Permanent link

Direct link
A method and a case study for the selection of the best available tool for mobile device forensics using decision analysis
Stockholm University, Faculty of Social Sciences, Department of Computer and Systems Sciences.
Number of Authors: 3
2016 (English)In: Digital Investigation. The International Journal of Digital Forensics and Incident Response, ISSN 1742-2876, E-ISSN 1873-202X, Vol. 16, S55-S64 p.Article in journal (Refereed) Published
Abstract [en]

The omnipresence of mobile devices (or small scale digital devices - SSDD) and more importantly the utility of their associated applications for our daily activities, which range from financial transactions to learning, and from entertainment to distributed social presence, create an abundance of digital evidence for each individual. Some of the evidence may be a result of illegal activities that need to be identified, understood and eventually prevented in the future. There are numerous tools for acquiring and analyzing digital evidence extracted from mobile devices. The diversity of SSDDs, types of evidence generated and the number of tools used to uncover them posit a rather complex and challenging problem of selecting the best available tool for the extraction and the subsequent analysis of the evidence gathered from a specific digital device. Failing to select the best tool may easily lead to incomplete and or improper extraction, which eventually may violate the integrity of the digital evidence and diminish its probative value. Moreover, the compromised evidence may result in erroneous analysis, incorrect interpretation, and wrong conclusions which may eventually compromise the right of a fair trial. Hence, a digital forensics investigator has to deal with the complex decision problem from the very start of the investigative process called preparatory phase. The problem could be addressed and possibly solved by using multi criteria decision analysis. The performance of the tool for extracting a specific type of digital evidence, and the relevance of that type of digital evidence to the investigative problem are the two central factors for selecting the best available tool, which we advocate in our work. In this paper we explain the method used and showcase a case study by evaluating two tools using two mobile devices to demonstrate the utility of our proposed approach. The results indicated that XRY (Alt(1)) dominates UFED (Alt(2)) for most of the cases after balancing the requirements for both performance and relevance.

Place, publisher, year, edition, pages
2016. Vol. 16, S55-S64 p.
Keyword [en]
Digital forensics, Mobile device forensics, Mobile device forensics tools, Evaluation, Multi-criteria decision analysis, Digital evidence, Digital investigation, Expected utility, Total ranking, Hypothesis testing
National Category
Computer and Information Science
URN: urn:nbn:se:su:diva-129997DOI: 10.1016/j.diin.2016.01.008ISI: 000373599000006OAI: diva2:927303
Available from: 2016-05-11 Created: 2016-05-09 Last updated: 2016-07-06Bibliographically approved

Open Access in DiVA

No full text

Other links

Publisher's full text

Search in DiVA

By author/editor
Popov, Oliver
By organisation
Department of Computer and Systems Sciences
In the same journal
Digital Investigation. The International Journal of Digital Forensics and Incident Response
Computer and Information Science

Search outside of DiVA

GoogleGoogle Scholar
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

Altmetric score

Total: 3 hits
ReferencesLink to record
Permanent link

Direct link