Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

There are many challenges in the field of mobile forensics, one of which is limited resources, in the sense that the rapid development of mobile technology and the increase in the number of smartphone devices are not matched by the development of mobile forensic technology and the development of mobile forensic technology [29, 30]. Existing forensic tools to overcome these challenges need to do a comparative analysis of instant messaging features and forensic tools [31, 32]. Comparisons are not only on the performance of forensic tools but also on forensic frameworks such as the National Institute of Justice (NIJ) [26, 33]. Integrated Digital Forensic Investigation Framework (IDFIF) [34] dan Digital Forensics Research Workshop (DFRWS) [35, 36].

In a study, Sutikno et al. [37] compared instant messaging features. An investigation has been launched into the three services, WhatsApp, Viber, and Telegram. The result of this study, in third place, is that Viber has a very functional security feature as its main feature. In second place, Telegram provides synchronization capabilities, lightning-fast service, reliable backup, and enhanced security features. The first place is WhatsApp because it is the most popular among smartphone users in the world, accounting for about 60% of the total. Despite the fact that WhatsApp dominates the social media space due to its simplicity and is backed by the giant that is Facebook, Telegram offers a better platform.

Another study conducted by Dogan and Akbal [38] using Oxygen Forensic Suite 2014 and MOBILedit Forensics revealed that each forensic tool has advantages and disadvantages. Digital crime cases involving smartphone devices require the use of a variety of forensic tools with varying capabilities. According to the findings of this study, MOBILedit Forensics has a run time advantage, while Oxygen Forensic Suite 2014 has an advantage in terms of artifact analysis.

In a study, Osho and Ohida compared the performance of four different mobile forensic tools to obtain from android-based smartphones with a concentration on deleted data [39]. The purpose of this study is to determine how various types of data artifacts that exist in various types of mobile phones can be extracted in different ways using AccessData FTK imager, Encase, MOBILedit, and Oxygen Forensic Suite.

Table 2. Summary of previous research

Padmanabhan et al. [40], compared and analyzed proprietary and open source forensic tools. The tools compared were The Sleuth Kit (TSK) Autopsy, SANS SIFT, MOBILedit Forensics, and Cellebrite UFED. According to the findings of this study, open source forensic tools have advantages in terms of user count, flexibility in terms of use with console commands or GUI-based applications, logging capabilities, and error tolerance. Meanwhile, proprietary forensic tools outperform generic forensic tools in terms of processing speed, data extraction accuracy, analytical skills, and ability to recover deleted data.

To obtain digital evidence from the MiChat App, this investigative process necessitates an analytical structure and a set of forensic tools. In this study, the researcher will attempt to describe the investigative steps taken to obtain digital evidence as well as conduct a comparative analysis of the performance of forensic tools based on the digital evidence and digital features obtained. Table 2 is a summary of previous research.

2.1 Mobile digital and mobile forensics

Digital forensics is the use of computer science and technology for the purpose of obtaining digital evidence that can be used against perpetrators. Mobile Forensic is one of many areas of Digital Forensic [41].

Mobile Forensics is the science that performs the process of recovering digital evidence from mobile devices in an appropriate manner under forensic conditions. Mobile forensics is required as mobile-based services become more popular and attract more users. The popularity of mobile computing and mobile commerce is increasing the demand for mobile transactions [42, 43].

The difficulty in conducting cellular transactions stems from the large number of cellular service providers with fast and secure networks. To protect users from abuse by irresponsible individuals, online transactions made via mobile devices must be highly secure.

2.2 Digital evidence

If digital evidence is not handled properly, it will become fragile, changeable, and vulnerable. Any type of alteration involving digital evidence will either lead to incorrect conclusions or become obsolete. Determination of the steps taken in the acquisition of digital evidence in accordance with [44, 45]:

1. Digital media as evidence.
2. Physical arrangement of digital storage media.
3. Use Write-Protect, hashing, and other techniques to ensure the integrity and authenticity of digital evidence.
4. Only authorized people have access to digital evidence, and no one may use electromagnetic devices near digital evidence.
5. Storage conditions and media configuration documentation.
6. Duplicate/imaging digital evidence procedures and devices used for digital forensic data acquisition are substandard.
7. Information documentation and digital device configuration.

2.3 Oxigen forensic detective

OFD is data extraction and analysis software for mobile phones, smartphones, and tablets. The tool provides a number of hash algorithms, one of which can be selected for each investigation case. The OFD can also provide general information about the smartphone and the networks connected to it. Another useful feature of this tool is the ability to recover all contacts, SMS, MMS, and user files [46, 24].

2.4 MOBILedit forensic express

MFE is a forensic tool that can perform both logical and physical acquisitions, similar to OFD. The software can obtain phone system information as well as other information such as contacts, text messages, and pictures. MOBILedit supports calendar, notes, reminders, raw app data, IMEI, operating system, firmware including SIM details (IMSI), ICCID, contact book, call history, text messages, multimedia files, and location area information [15, 47].

2.5 Cybercrime

Despite the fact that cybercrime is a popular and widely used term, there is no universally accepted standard definition of cybercrime. However, several organizations, including the United Nations, have begun to define cybercrime (United Nations). Cybercrime is defined by the United Nations as any illegal behavior committed through the provision of a computer system or system or network, including crimes such as illegal possession, provision, or distribution of information via a computer system or network [48, 49]. Cybercrime is defined as a crime committed with the use of information technology as an instrument or target, and digital forensics essentially answers the following questions: when, what, who, where, how, and why it is committed [25]. This is accomplished by employing a computer network as a tool or a computer as an object, for profit or not, and there are elements that can cause harm to others.

The DFRWS method's function is not restricted to retrieving relevant digital evidence as just a step in resolving digital crime submitted to court, but it can also be used in a comparative evaluation of the performance of forensic tools used. The findings of this study's comparative analysis of these forensic tools will be presented at the reporting stage. The following are the steps for collecting and analyzing data using the DFRWS method:

4.1 Identification

Identification determines which device to process. This study succeeded in identifying the Asus Zenfone C smartphone, which was used as physical evidence for the drug trafficking case that occurred. With some specifications in detail shown in Table 4.

Table 4. Identification results of Asus Zenfone C

Bukti Fisik	Spesifikasi	Information
biao_.png	Manufacturer	Asus
	Product	Asus_Z007
	HW Revision	KVTA9L
	Platform OS	Android 4.4.2 KitKat
	Chipset	Intel Atom Z2520
	RAM	1 GB
	ADB Backup Password	1234
	IMEI	237876069027680
	Rooted	Yes
	Simcard	Yes

4.2 Preservation

The stage of isolating the smartphone from the telecommunications network (airplane mode). Quarantine processes must be in place to avoid anything that could compromise or affect digital evidence's integrity and disprove claims that evidence has been destroyed. After the isolation process, evidence backup will be carried out in the form of cloning or processing of evidence image files using equipment that clones smartphones into safes.

4.3 Collection

Table 5. MiChat application data backup information

At this stage, the collection of evidence is carried out to maintain the integrity of the physical and digital evidence so that it does not change. Many applications can be used for cloning or physical imaging. In this study, the Asus Zenfone C smartphone cloning process was carried out using MFE. The cloning process and results are as shown in Figure 4. In Table 5, information from the MiChat application data was successfully backed up.

4.png

Figure 4. Physical Imaging using MFE

4.4 Examination

Examination is the stage of examining the data collected from the imaging process by extracting artifacts. The selection of artifacts is very important considering that there are many types of extracted artifacts, such as log files and databases, that can be analyzed further. The investigation process uses forensic techniques and tools to analyze and process data evidence so that the digital evidence sought can be found. Other things, such as filtering hash files, also need to be done to validate the authenticity of digital evidence. In Figure 5, investigators carry out the imaging file extraction process using the MFE tool. In Table 6, types of digital evidence that will be extracted from physical evidence have been determined and will be used as parameters for this research.

5.png

Figure 5. Imaging file extraction process

Table 6. Parameters of digital evidence in research

4.5 Analysis

Analysis is a process in which the results of the examination are viewed as a whole in order to obtain digital evidence. This stage restricts the search process to specific points that are linked to specific data or applications. The MiChat application is the search limitation in this study. The analysis stage carried out by OFD resulted in a data conversation with one of the MiChat contacts with indications of drug trafficking transactions, as shown in Figure 6 and Figure 7. Analysis of MiChat contacts suspected of being the perpetrator's phone number The offender profile of a girl is shown in Figure 8.

6.png

Figure 6. Digital text chat and contact data on OFD tools

7.png

Figure 7. Digital text chat and contact data on OFD tools

8.png

Figure 8. Images data on OFD tools

Based on the results of the analysis using OFD tools, there are indications of drug trafficking transactions. To get more detailed data, an analysis of the next tool is carried out. The results of the examination using the DB4S tool did not produce images or photos due to software limitations, but the conversation data was obtained completely. The analysis shows exactly the same conversation as the one shown in OFD. Figure 9 shows the outcomes of conversational analysis using DB4S.

9.png

Figure 9. Digital text chat data on DB4S tools

As for FMF tools, they are used to obtain digital data for audio, video, and web caches to complete the required data so that the objectives of this research can be achieved.

4.6 Presentasion

Presentation is the last stage in the DFRWS method. The presentation will be presented in two tables, one for software features and one for digital evidence obtained by each device. The results of the comparison based on features are as shown in Table 7.

Table 7. Comparison results of forensic tools features

According to the experimental results, the researchers used calculations with index numbers to determine the performance of each forensic tool. The index number is calculated as an overall score index, as shown in Eq 1.

$p a r=\frac{\sum a r 0}{\sum a r T} \times 100 \%$     (1)

Information:

Par=Index number as a percentage

ar0=Forensic Tools-obtained Evidence/Digital Artifacts

arTTotal Digital Evidence/Artifact

Based on the DFWRS method, OFD has a powerful advantage, by calculating the index number of each forensic tool using equation 1. OFD has the highest index score of 100 percent, MFE and FMF have index numbers of 80% and 90%, respectively. Comparison results based on digital evidence as shown in Table 8.

Table 8. Evaluate the capabilities of forensic tools based on digital evidence

Table 8 shows the outcomes of the performance analysis performed on each forensic tool in relation to the digital evidence obtained. Using the same equation, OFD got a performance index score of 83.3%. MFE received a performance index score of 66.7%, FMF received a good score  100% on the performance index because it obtained most six categories of MiChat digital evidence.

4.7 Discussion

Based on an analysis of the comparison and evaluation of the capabilities of mobile forensic tools in handling digital crime cases through the MiChat application and by applying the DFRWS method, which is already qualified to handle digital evidence according to procedures from the initial stages of identification, preservation, collection, examination, analysis, and reporting, Analysis using four forensic tools, namely MFE, DB4S, OFD, and FMF, obtained evidence of text chat, contacts, images, audio, video, and web cache. The best forensic tool for acquiring evidence is FMF, with a success index of 100%, but it has the disadvantage that it takes a long time during the acquisition process. In terms of forensic features, OFD is more capable, but the weakness is that many features are locked, with an index score of 83.3%. This research contributes to the world of cybercrime involving smartphone devices and can later provide a reference to an investigator regarding the best mobile forensic tools. It can also be used to analyze crimes involving data loss or data recovery. Based on the differences from previous comparison studies of mobile forensic tools in handling evidence, especially Android-based applications on smartphones, the results of previous studies can be seen in Table 9.

Table 9. Comparison of previous research with research that has been done