Event Reconstruction on Android Devices Through SQLite Databases

Art der Arbeit:

Bachelor Thesis

Betreuer:

Groß, Tobias
Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)
E-Mail: tobias.gross@cs.fau.de

Beschreibung der Arbeit:

Kälber et. al. [1] developed the Py3xF framework, which allows to extract characteristic traces [2] of user actions in applications from the filesystem and memory dumps. As traces, changes in the metadata of files on the filesystem are used. To create these traces, a virtualized environment, in which the action is automated performed multiple times, is used. Currently, only traces on Windows can be created and extracted.

In this thesis, the Py3xF framework shall be extended to use a virtualized Google Android system. Thereby the capability to automatized execute apps and simulate user input has to be integrated. Second, complete dumps of all filesystems and main memory of the virtual device have to be created. To evaluate the implementation, characteristic traces should be extracted after the simulation of a set of app usages.

[1] Kälber, S.; Dewald, A.; Freiling, F.; Forensic Application-Fingerprinting Based on File System Metadata (http://ieeexplore.ieee.org/abstract/document/6568558/)
[2] Dewald A.; Forensische Informatik (https://books.google.de/books?id=DmW9EDwLE90C&printsec=frontcover&source=gbs_ViewAPI&redir_esc=y#v=onepage&q&f=false)

Schlagwörter:

Android Forensics

Bearbeitungszustand:

Die Arbeit ist bereits abgeschlossen.
Bearbeiter:	Alexander Hildt
Abgegeben am:	04.11.2019