title: Forensic Taxonomy of Android Social Apps.
abstract: An Android social app taxonomy incorporating artifacts that are of forensic interest will enable users and forensic investigators to identify the personally identifiable information (PII) stored by the apps. In this study, 30 popular Android social apps were examined. Artifacts of forensic interest (e.g., contacts lists, chronology of messages, and timestamp of an added contact) were recovered. In addition, images were located, and Facebook token strings used to tie account identities and gain access to information entered into Facebook by a user were identified. Based on the findings, a two-dimensional taxonomy of the forensic artifacts of the social apps is proposed. A comparative summary of existing forensic taxonomies of different categories of Android apps, designed to facilitate timely collection and analysis of evidentiary materials from Android devices, is presented.
authors.affiliation: Information Assurance Research Group, University of South Australia, Adelaide, SA, 5095, Australia.
authors.forename: Abdullah
authors.initials: A
authors.lastname: Azfar
authors.affiliation: Information Assurance Research Group, University of South Australia, Adelaide, SA, 5095, Australia.|Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX, 78249-0631, USA.
authors.forename: Kim-Kwang Raymond
authors.initials: KR
authors.lastname: Choo
authors.affiliation: School of Information Technology and Mathematical Sciences, University of South Australia, Adelaide, SA, 5095, Australia.
authors.forename: Lin
authors.initials: L
authors.lastname: Liu
keywords: digital forensics; forensic science; forensic taxonomy; mobile app forensics; mobile forensics; social app taxonomy