dissertation

Figure 5.3: Warning shown when enabling USB debuggingUSB cable is connected or not, and whether the phone is in debugging mode.The source code for this application is in appendix C.1.5.3 Anti-forensics modulesBased on the examination of the forensics tools and of the USB triggering,several anti-forensics modules will be constructed. Some of the modules willdepend on previous ones, and some will be self-contained.5.3.1 Response delaysAnti-forensic applications which operate outside of the call path of the applicationuploaded to the phone by the forensics tool have only a small windowof time to do their work, between detecting the forensic application and theextraction being completed. For example, Azadegan et al. [46] reporteda gap of several seconds between the installation of the forensic applicationand the start of extraction, while Rouwendal [83] reported being able to make30