Mohammed Hasheem, Yusoof (2016) Mobile forensic triage for damaged phones using M_Triage. Doctoral thesis, Universiti Tun Hussein Onn Malaysia.
|
Text
24p YUSOOF MOHAMMED HASHEEM.pdf Download (822kB) | Preview |
|
![[img]](http://eprints.uthm.edu.my/style/images/fileicons/text.png) |
Text (Full Text)
YUSOOF MOHAMMED HASHEEM WATERMARK.pdf Restricted to Registered users only Download (13MB) | Request a copy |
Abstract
Mobile forensics triage is a useful technique in a digital forensics investigation for recovering lost or purposely deleted and hidden files from digital storage. It is particularly useful, especially when solving a very sensitive crime, for example, kidnapping, in a timely manner. However, the existing mobile forensics triage tools do not consider performing a triage examination on damaged mobile phones. This research addressed the issues of performing triage examination on damaged Android mobile phones and reduction of false positive result generated by the current mobile forensics triage tools. Furthermore, the research addressed the issues of ignoring possible evidence residing in a bad block memory location. In this research a new forensics triage tool called M_Triage was introduced by extending Decode’s framework to handle data retrieval challenges on damaged Android mobile phones. The tool was designed to obtain evidence quickly and accurately (i.e. valid address book, call logs, SMS, images, and, videos, etc.) on Android damaged mobile phones. The tool was developed using C#, while back end engines was done using C programming and tested using five data sets. Based on the computational time processing comparison with Dec0de, Lifter, XRY and Xaver, the result showed that there was 75% improvement over Dec0de, 36% over Lifter, 28% over XRY and finally 71% over Xaver. Again, based on the experiment done on five data sets, M_Triage was capable of carving valid address book, call logs, SMS, images and videos as compared to Dec0de, Lifter, XRY and Xaver. With the average improvement of 90% over DEC0DE, 30% over Lifter, 40% over XRY and lastly 61% over Xaver. This shows that M_Triage is a better tool to be used because it saves time, carve more relevant files and less false positive result are achieved with the tool.
| Item Type: | Thesis (Doctoral) |
|---|---|
| Subjects: | H Social Sciences > HV Social pathology. Social and public welfare > HV7231-9960 Criminal justice administration > HV7551-8280.7 Police. Detectives. Constabulary > HV8031-8080 Police duty. Methods of protection > HV8073-8079.35 Investigation of crimes. Examination and identification of prisoners |
| Divisions: | Faculty of Computer Science and Information Technology > Department of Web Technology |
| Depositing User: | Miss Afiqah Faiqah Mohd Hafiz |
| Date Deposited: | 01 Sep 2021 07:55 |
| Last Modified: | 01 Sep 2021 07:55 |
| URI: | http://eprints.uthm.edu.my/id/eprint/814 |
Actions (login required)
 |
View Item |