Digital Forensic Artifact Collection Technique using Application Decompilation

Abstract

Nowadays, many applications tend to collect user profile, such as location, usage trace and so on, even if it is not malicious. This information can be important clues in the criminal investigation. So, the technique is needed which extract artifacts from applications using decompilation. We describe a method for selecting and analyzing forensic artifacts from the Android application with a share of over 80% of mobile devices. Based on the static analysis method, we propose a method for automatically collecting forensic artifact. The effectiveness of the proposed idea is proved by simulation.