dissertation

Chapter 6ConclusionsThis dissertation set out with an hypothesis and a number of research questions.The hypothesis was that it is possible to modify the Android operatingsystem to present false information to the forensics tools Cellebrite and XRY,and the research questions were:• Which components of the Android operating system do the forensicstools trust?• Is it possible to modify these components to present false information?• Can the presence of a forensic analysis tool be detected?• Is it possible to make the presentation of false information reversible,such that the phone will revert to presenting the real information afterthe forensic analysis?6.1 TrustForensic analysts try to minimise the trust they place in the equipment underexamination. This is expressed by disassembling PCs and examining themcomponent by component, and by using forensics tools instead of operatingsystems to interpret the data on as low a level a possible. This is hard to doon a phone, where disassembling requires much effort, time and resources,49