dissertation

Chapter 7Future work7.1 Decompilation of forensic applicationsStandard Android applications are written in Java and compiled to Javabytecode. They are then translated to the Android-specific Dalvik [20] virtualmachine, which runs the application on the phone. The application canbe turned back into Java bytecode using tools such as dex2jar [21], afterwhich generic Java reverse engineering techniques are available, such as theJD decompiler [52] which can turn Java bytecode into human-readable Javasource code.Both Cellebrite and XRY upload an application to the phone through theUSB debug connection. This application reads the requested data and sendsit to the tool. After extraction, the tool stops and deletes the application.Study of these applications could reveal avenues for more accurate detectionof forensic tools and vulnerabilities in the applications. Experiments couldbe conducted to see if it is possible to make the application accept commandsfrom an anti-forensic application running on the phone as well as the externalforensic tool, any logs would implicate the forensic tool as responsible forthe resulting behaviour. It’s plausible, based on previous research pointingto forensic software being insecure and unprepared to deal with a hostileenvironment [75], that such vulnerabilities would be found.Even if no actual vulnerabilities are found, there is information suggesting54