Testing Framework for Mobile Device Forensics Tools

• Main Authors: Maxwell Anobah, Shahzad Saleem, Oliver Popov
• Format: Article
• Language: English
• Published: Association of Digital Forensics, Security and Law 2014-09-01
• Series: Journal of Digital Forensics, Security and Law
• Subjects: mobile device forensics; digital forensics; forensics tool testing; forensics tool evaluation; testing framework; support profiles
• Online Access: http://ojs.jdfsl.org/index.php/jdfsl/article/view/281
• ISSN: 1558-7215; 1558-7223

The proliferation of mobile communication and computing devices, in particular smart mobile phones, is almost paralleled with the increasing number of mobile device forensics tools in the market. Each mobile forensics tool vendor, on one hand claims to have a tool that is best in terms of performance, while on the other hand each tool vendor seems to be using different standards for testing their tools and thereby defining what support means differently. To overcome this problem, a testing framework based on a series of tests ranging from basic forensics tasks such as file system reconstruction up to more complex ones countering antiforensic techniques is proposed. The framework, which is an extension of an existing effort done in 2010, prescribes a method to clearly circumscribe the term support into precise levels. It also gives an idea of the standard to be developed and accepted by the forensic community that will make it easier for forensics investigators to quickly select the most appropriate tool for a particular mobile device.