dissertation

4.3 Experimental designThe experiments will be divided into two stages, examination of current behaviourand implementation of anti-forensic modifications. The implementationis described in chapter 5, and the source code is in appendix C.4.3.1 Examination of current behaviourBefore any anti-forensics can be implemented, it is necessary to determineif and how the operating system can be modified, and how the operatingsystem and the forensics tools currently behave. This will be accomplishedthrough the following steps:Step 1 To investigate the possibility of operating system modifications, thesource code for the CyanogenMod community distribution of Androidwill be downloaded, built and installed according to the CyanogenModproject’s instructions [23, 24].Step 2 Once the phone is running this version of CyanogenMod, modificationswill be introduced to trace the behaviour of the forensics tools.Content providers are applications that wrap databases on the phone,performing security checks and format conversions as required by theAndroid specifications. On the assumption that both Cellebrite andXRY use content providers to access data on the phone, these modificationswill take the form of altering the content providers to providelogs of how they are called.Initial investigation will be limited to the content provider responsiblefor the phone’s contact list. Once data is available from that contentprovider, the techniques developed will be extended to cover SIM contactsand SMS messages, to prove that they can be generalised.Step 3 From knowing how the calls are made, the Android documentationwill be consulted for information on the format of the returned datafor each call.24