title: An Android Communication App Forensic Taxonomy.
abstract: Due to the popularity of Android devices and applications (apps), Android forensics is one of the most studied topics within mobile forensics. Communication apps, such as instant messaging and Voice over IP (VoIP), are one popular app category used by mobile device users, including criminals. Therefore, a taxonomy outlining artifacts of forensic interest involving the use of Android communication apps will facilitate the timely collection and analysis of evidentiary materials from such apps. In this paper, 30 popular Android communication apps were examined, where a logical extraction of the Android phone images was collected using XRY, a widely used mobile forensic tool. Various information of forensic interest, such as contact lists and chronology of messages, was recovered. Based on the findings, a two-dimensional taxonomy of the forensic artifacts of the communication apps is proposed, with the app categories in one dimension and the classes of artifacts in the other dimension. Finally, the artifacts identified in the study of the 30 communication apps are summarized using the taxonomy. It is expected that the proposed taxonomy and the forensic findings in this paper will assist forensic investigations involving Android communication apps.
authors.affiliation: Information Assurance Research Group, University of South Australia, Adelaide, SA, 5001, Australia.
authors.forename: Abdullah
authors.initials: A
authors.lastname: Azfar
authors.affiliation: Information Assurance Research Group, University of South Australia, Adelaide, SA, 5001, Australia. raymond.choo@fulbrightmail.org.|Department of Information Systems and Cyber Security, University of Texas at San Antonio, One UTSA Circle - San Antonio, TX 78249-0631, USA. raymond.choo@fulbrightmail.org.
authors.forename: Kim-Kwang Raymond
authors.initials: KK
authors.lastname: Choo
authors.affiliation: School of Information Technology and Mathematical Sciences, University of South Australia, Mawson Lakes, SA, 5095, Australia.
authors.forename: Lin
authors.initials: L
authors.lastname: Liu
mesh_terms: D040421:Cell Phone; D003142:Communication; D003415:Crime; D044707:Forensic Sciences; D020407:Internet; D063731:Mobile Applications
keywords: Android forensics; Viber app; WeChat app; communication app taxonomy; digital forensics; forensic science; line app; mobile app