dissertation

applications, there is a limit to the amount and timeliness of informationavailable to the anti-forensic application for determining when to trigger. Ina modified operating system, the triggering code can be located anywhere inthe system (except in the uploaded forensic application itself), making muchmore detailed information available without having to wait for and parse logmessages.For triggering on the connection of a USB cable, previous approacheshave used older versions of the Android operating system which only makeavailable very general information about the USB connection. Contemporaryversions allow the triggering code to single out USB debugging connections,which are commonly used by forensics tools but rarely by end users.2.2.3 Timing constraintsAnti-forensic applications which run separately from the forensics applicationare limited in how much they can influence its behaviour, again because ofthe operating system-enforced security separation. It is therefore vital thatany manipulations of data are completed before extraction starts.If the operating system is modified to insert anti-forensics code into thecall path of the forensic tool, this constraint disappears, since the code hasfull control of what data to return to the tool and when. The only remainingtiming constraint is on human timescales, when the analyst gives up waitingor the tool determines that an excessive delay means that an error hasoccurred.2.2.4 PermanenceExcept for Distefano et al. [51], who offer manual restoration of hidden data,all approaches described change the data stored on the phone permanently.While this may be optimal in some cases, it would be desirable to have theoption of making non-permanent modifications, so that the legitimate usercan restore all data after regaining control of the phone.Non-permanent modifications also present the option of having different10