Validation of Timelines Extracted from Android Smartphones

Art der Arbeit:

Bachelor Thesis

Betreuer:

Groß, Tobias
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
E-Mail: tobias.gross@cs.fau.de

Beschreibung der Arbeit:

Today, digital investigations have to deal with rapidly changing applications for mobile devices. First, new Instant Messengers targeting specific use cases arise in short time intervals. Second, updates of mobile device applications have short release cycles and you can find dozens of different versions of the same app in usage. Often, forensic analysis software which parse file formats statically can not deal with the newest file structures of updated apps or are not designed to deal with niche software like messengers with a small user base.

Most digital forensic investigations need times and dates to build a concrete link between the real world and the digital evidence. Therefore dates are of most importance in this thesis.

In this thesis, the extraction of times and dates from files should be automated and independent of concrete file structures. Therefore heuristics and patterns to identify time/date fields should be developed. Also a new methodology using this patterns has to be created. With this methodology files containing times or dates on Android should be identified (log files, messenger databases, etc.).

Schlagwörter:

Android Forensics

Bearbeitungszustand:

Die Arbeit ist bereits abgeschlossen.
Bearbeiter:	Ralf Gebhardt
Abgegeben am:	01.08.2019