Chameleon Forensics (Android): Assume Adversarial Logical Extraction Forensic Tool

However, what if the device is intentionally modified to detect and disrupt forensic extraction attempts? Anti-forensic techniques can interfere with commonly implemented acquisition methods such as ADB-based extraction or forensic agent deployment, potentially preventing investigators from successfully collecting forensic data.<br><br>This work builds upon the mobile device forensic acquisition process outlined in NIST SP 800-101 Revision 1.

Extending this framework, the proposed approach introduces two additional considerations for Android forensic acquisition in potentially adversarial environments. First, it incorporates a pre-acquisition triage step aimed at helping examiners quickly identify suspicious applications on the device that may interfere with forensic acquisition. Second, it proposes that acquisition workflows should be adversarial-aware, designed in a manner to improve the reliability of forensic evidence collection when anti-forensic mechanisms may be present on the device.<br><br>The resulting tool introduces an Android logical acquisition tool that assumes the target device may be adversarially modified to disrupt forensic acquisition through known anti-forensic mechanisms.