Evaluation framework for detecting manipulated smartphone data

Abstract

Ever improving technology allows smartphones to become an integral part of people’s lives. The reliance on and ubiquitous use of smartphones render these devices rich sources of data. This data becomes increasingly important when smartphones are linked to criminal or corporate investigations. To erase data and mislead digital forensic investigations, endusers can manipulate the data and change recorded events. This paperinvestigatestheeffectsofmanipulatingsmartphonedataon both the Google Android and Apple iOS platforms. The deployed stepsleadstotheformulationofagenericprocessforsmartphone data manipulation. To assist digital forensic professionals with the detection of such manipulated smartphone data, this paper introduces an evaluation framework for detecting manipulated smartphone data. The framework uses key traces left behind as a result of the manipulation of smartphone data to construct techniques to detect the changed data. Assessment of the evaluation framework involves three distinct theoretical scenarios that involve the deletion and modi cation of existing data, as well as a failed attempt to insert fabricated data. The results produced by the evaluation framework suggest the framework can assist with the detection of manipulated smartphone data. The purpose of this research study was to demonstrate the manipulation of smartphone data and present an evaluation framework to detect such manipulated data.