In today’s work place where corporations allow employees to use their own smart phones to access their company’s network and sensitive data, it is essential to ensure the security of said data. When an employee smart phone is compromised, companies will rely on the remote wipe command that attempts to remove sensitive data. In this thesis, we analyze the effectiveness of remote wipe commands on the Apple iPhone and Android model devices and demonstrate how data can be recovered following a remote wipe procedure. We conduct two experiments on each device to verify whether remote wipe is a viable defense mechanism or not. Furthermore, we touch on the subject of mobile forensics used by law enforcement and review methods and techniques used to recover data for use as evidence in criminal cases.

In today’s work place where corporations allow employees to use their own smart phones to access their company’s network and sensitive data, it is essential to ensure the security of said data. When an employee smart phone is compromised, companies will rely on the remote wipe command that attempts to remove sensitive data. In this thesis, we analyze the effectiveness of remote wipe commands on the Apple iPhone and Android model devices and demonstrate how data can be recovered following a remote wipe procedure. We conduct two experiments on each device to verify whether remote wipe is a viable defense mechanism or not. Furthermore, we touch on the subject of mobile forensics used by law enforcement and review methods and techniques used to recover data for use as evidence in criminal cases.

<p>  </p> <p>With the Internet of Things (IoT) development, vehicles have become an essential part of this data transmission network. In order to access the vehicle's status via personal mobile devices, an increasing number of car manufacturers have began to provide mobile applications; some third-party companies offer Bluetooth adaptors for the On-Board Diagnostics-II (OBD-II) port on vehicles made post-1996 in the United States. By connecting the smartphone and the vehicle with either of these methods, the mobile applications can retrieve detailed data and the history of the vehicle. This research aims to answer what forensically relevant artifacts can be recovered from the MB Companion, FIXD, and Nonda ZUS applications. The research methods include adapting the National Institute of Standards and Technology (NIST) forensics framework, generating mock user data, extracting user data, and conducting in-depth digital forensics analysis. The recovered geolocation data, the vehicle-related artifacts, the applications on different vehicle brands, and the applications on various device platforms are primarily examined in the research.</p>

<p> Browsers are used as a medium to perform various activities on the Internet and mobile applications are used on mobile devices. They let users connect to the Internet and access different services such as sending emails, watching videos, using banking services, etc. The increase in the usage of the Internet, personal computers, and mobile phones led financial institutions to democratize their services and provide omnipresent and cost-effective services to their customers, in turn attracting a large customer base. Many of these financial institu?tions store and manage sensitive user information such as account numbers and usernames, passwords, Social Security Numbers (SSNs), etc. Due to the nature of the sensitive infor?mation that these institutions manage, it makes a perfect bait for attackers to exploit and perform cyber attacks. Most of the forensic and security research observed in the bank?ing ecosystem focused on foreign financial institutions and mobile banking applications for Android. However, no forensic research has been conducted on the mobile and browser ap?plications of US financial institutions. In this research, I performed a forensic analysis on both browser and mobile applications (both Android and iOS) of US financial institutions. I conducted a forensic investigation on the JP Morgan Chase (Chase), Purdue Federal Credit Union (PFCU), Discover, and CapitalOne banks. This research found what information these banking applications store locally and where they store them to assist digital forensic investigators in investigations. </p>

Mobiltelefoner har blivit grundläggande för extrahering av digitala artefakter i fo-rensiska utredningar. Androids Linuxbaserade operativsystem medför större möj-ligheter för anti-forensiska metoder, detta gör att kunskap om anti-forensik äressentiell för dagens IT-forensiska utredare. I denna studie belyses effekten avanti-forensik i Androidbaserade mobila enheter samt så upplyses det om dagensanti-forensiska attack metoder mot forensiska verktyg. Genom experiment så vi-sas det hur man kan förhindra ett forensisk verktyg från att extrahera data medanvändning av ett simpelt script. / Mobile phones have become essential for the extraction of digital artifacts in foren-sic investigations. Android’s Linux-based operating systems bring greater potentialfor anti-forensic methods, which means that knowledge of anti-forensics is essen-tial to today’s IT forensic investigators. In this study, the effect of anti-forensicson Android-based mobile devices is highlighted, as well as revealing today’s anti-forensic attack methods against forensic tools. By experiment, it is shown how toprevent a forensic tool from extracting data by using a simple script.

This report aims to draw a comparison between two commercial mobile forensics and recovery tools, Magnet AXIOM and MOBILedit. A thorough look at previously done studies was helpful to know what aspects of the data extractions must be compared and which areas are the most important ones to focus upon. This work focuses on how the data extracted from one tool compares with another and provides comprehensive extraction based on different scenarios, circumstances, and aspects. Performances of both tools are compared based on various benchmarks and criteria. This study has helped establish that MOBILedit has been able to outperform Magnet AXIOM on more data extraction and recovery aspects. It is a comparatively better tool to get your hands on.

The growing popularity of instant messaging has led to the conception of several new applications over the span of the past decade. This has opened up an attack surface for cybercriminals to target susceptible app users. GroupMe is a free IM app widely used by students and so far, no comprehensive forensic analysis has been performed to aid forensic practitioners in recovering evidence from GroupMe on smartphones. This research performs a detailed analysis of the digital artifacts left by the app on Android and iOS devices. This was achieved by installing the app on two mobile phones (Samsung Galaxy S7 Edge and iPhone 6), and identifying each artifact created by performing a series of actions in the app ranging from sending texts, to sharing images and documents, along with their location. Using Cellebrite UFED and Magnet AXIOM, a significant number of artifacts were accurately recovered mainly from the “GroupMe.sqlite” and “GroupMe.sqlite-wal” databases. Out of the 335 artifacts populated on the iPhone, 317 were correctly recovered by both UFED and AXIOM, resulting in an accuracy of 94.62%. No GroupMe related artifacts could be recovered from the Android device. This was due to several physical imaging and rooting limitations imposed by the Samsung SM-935A model, which was used during the study.

<p dir="ltr">FemTech is a booming subset of mHealth applications that was worth $51 billion in 2021 (Stewart, 2022b). FemTech largely focuses on menstruation, pregnancy, and fertility tracking. As with any technology, it comes with privacy and security risks for users, but these risks are more acute due to the sensitive nature of the data being collected. While privacy and security shortcomings have been highlighted for years, concerns were discussed widely in the United States after the Supreme Court released its <i>Dobbs v. Jackson</i> decision on June 24, 2022, which overturned <i>Roe v. Wade</i>, a 1973 decision that protected abortion as a constitutional right and limited states’ abilities to place restrictions on abortions. With abortion no longer a constitutional right, many states have outlawed or heavily restricted the procedure, and individuals expressed concern about their digital data being used in investigations as it has been in select previous cases (e.g., <i>State of Indiana v. Purvi Patel</i>, 2015; <i>State of Mississippi v. Latice Fisher</i>, 2018; <i>The State of Nebraska v. Celeste Burgess</i>, 2023; <i>The State of Nebraska v. Jessica Burgess</i>, 2023). While Big Tech has been scrutinized for turning user data over to law enforcement, many have more heavily questioned the protections offered by period tracking app companies due to the abundant amount of health data these companies possess about their users (e.g., Basu, 2022; Bradley et al., 2022; Cole, 2022). These apps have historically fallen short in protections for their user data in general (e.g., Beilinson, 2020; <i>Developer of Popular Women’s Fertility-Tracking App Settles FTC Allegations That It Misled Consumers About the Disclosure of Their Health Data</i>, 2021; Quintin, 2017). Clue is one of the most popular FemTech apps with millions of downloads across the Apple App Store and Google Play Store, and the company has spoken out widely about their privacy protections in the wake of the <i>Dobbs v. Jackson</i> decision (<i>‎Clue Period Tracker & Calendar</i>, n.d.; <i>Clue Period Tracker & Calendar</i>, n.d.; <i>Clue’s Response to Roe vs Wade Decision</i>, 2022). This research presents a forensic analysis of Clue on both iOS and Android after two months of data population, finding that some user-entered data was available in the app cache or .db-wal files on both iOS and Android but was entirely erased after the deletion of the app on the phones. This research also presents results from a survey of 31 menstruators in the United States, finding that online privacy in general is a concern for many users, and most find it unacceptable for period tracking applications to share user health data with advertisers or law enforcement.</p>

<div>With the increased evolution in technology over the past decade, there has been a gradual inclination towards utilizing advanced tools, like location-based applications which incorporate features such as constant route or traffic updates with Global Positioning System (GPS), among</div><div>others, which aid in smooth living. Such applications gain access to private information of users, among their other life hack qualities, thus producing a highly vulnerable ground for data exposure such as current location. With the increase in mobile application-based attacks, there exists a</div><div>constant threat scenario in terms of criminal activities which pose an ultimate challenge while tackling large amount of data. This research primarily focuses on the extent of user-specific data that can be obtained while forensically collecting and analysing data from Waze and HEREwego</div><div>applications on Android and iOS platforms. In order to address the lack of forensic research on the above mentioned applications, an in-depth forensic analysis is conducted in this study, utilizing Cellebrite, a professional tool to provide and verify the evidence acquired, that aid in any digital forensic investigations. On the Waze application, 12 artifacts were populated on the Android device and 17 artifacts on the iOS device, out of which 12 artifacts were recovered from the Android device (100% of the artifacts populated) and 12 artifacts from the iOS device (70.58% of the artifacts populated). Similarly on the HEREwego application, 14 artifacts were populated on the Android device and 13 artifacts on the iOS device, out of which 7 artifacts were recovered from the Android device (50% of the artifacts populated) and 7 artifacts from iOS device (53.84% of the artifacts populated).</div>

Android is the most used operating system in the world, because of this the probability of an android device being acquired in an investigation is high. To begin to extract data from an android device you first need to gain access to it. Mechanisms like full system encryption can make this very difficult. In this paper, the advantages and disadvantages of different methods of gaining access and extracting data from an android device with an unlocked bootloader are discussed. Many users unlock the bootloader of their android device to gain a much greater level of control over it. Android forensics on a device without a unlocked bootloader is very limited. It is therefore interesting to study how you can extract data from an android device that doesn’t have this limitation to android forensics. A literature study is done on previous related research to gather methods for gaining access and extracting data. The methods collected are then tested by performing experiments on a Oneplus 3 android 9 and Oneplus 8 android 11. The research of this paper found that it is possible to perform a brute force attack within a reasonable time against a PIN of length 4-5 or pattern of length 4-6 on the lock screen of an android device. It found that you can optimise the attack by performing a dictionary attack by using public lists of the most used PIN codes. A list of all possible pattern combinations sorted and optimised for a dictionary attack is generated based on statistics of pattern starting location and length. A proof of concept is made by creating a copy of a fingerprint with common cheap materials to gain access through the fingerprint sensor. A device image were able to be extracted by using a root shell through Android Debug Bridge and common command-line tools. Memory forensics were performed by using Frida and was able to extract usernames, passwords, and emails from Google Chrome and Gmail. The custom recovery image TWRP was used to boot the device, gain root access, and was able to extract a full device image with common command-line tools. The results of the TWRP backup feature is also analysed. The results of the data extraction is then analysed manually and with Autopsy.