Abstract:
Ever improving smartphone technology, along with the widespread use of the devices to accomplish daily tasks, leads to the collection of rich sources of smartphone data. Smartphone data are, however, susceptible to change and can be altered intentionally or accidentally by end-users or installed applications. It becomes, therefore, important to establish the authenticity of smartphone data, confirming the data refer to actual events, before submitting the data as potential evidence. This paper focuses on data created by smartphone applications and the techniques that can be used to establish the authenticity of the data. To identify authentic smartphone data, a better understanding of the smartphone, related smartphone applications and the environment in which the smartphone operates are required. From the gathered knowledge and insight, requirements are identified that authentic smartphone data must adhere to. These requirements are captured in a new model to assist digital forensic professionals with the evaluation of smartphone data. Experiments, involving different smartphones, are conducted to determine the practicality of the new evaluation model with the identification of authentic smartphone data. The presented results provide preliminary evidence that the suggested model offers the necessary guidance to identify authentic smartphone data.
