dissertation

aw contacts and a query-following state machine.The raw contacts method would look at queries for the URI 1 content://com.android.contacts/raw contacts. Such queries return contacts datain a format suited for automated processing, while a different URI (content://com.android.contacts/contacts) returns data suitable for humans and isused by the built-in contact list application 2 .This suggests that triggeringon the use of raw contacts would be a good fallback method, but caremust be taken not to trigger on legitimate applications. According to thedocumentation, it is primarily intended for use by applications that performcontact list synchronisation and other contact list management tasks.A query-following state machine would take advantage of the fact thatthe forensics tools make the same set of queries in the same order each time.XRY makes only two queries, each for an entire dataset, and presumablydoes all processing in the analysis tool. This does not leave much structureto trigger on. Cellebrite, on the other hand, makes seven preparatory queriesand then nine queries per contact (one each for the contact’s name, phonenumber, e-mail address, etc.).A state machine could look at the sevenpreparatory queries, or the nine queries for one contact, and from that seriesof queries determine that the queries come from Cellebrite and serve falsedata in response to the following queries.Another idea for a triggering mechanism can be had from the ACPOdigital forensics guidelines [53]. This recommends that mobile phones be disconnectedfrom the network before analysis, preferably using a Faraday cage.Presenting false data whenever the network connection is lost may thereforebe a valid anti-forensic strategy. The connection may be legitimately lostduring everyday use, for example by the user walking into a cellar. In thesecases, the phone functionality is unavailable to the user anyway, so the unavailabilityof phone-related data may not be a significant drawback. Forexample, no phone calls can be made, so hiding the contact list may notinconvenience the user.1 Uniform Resource Identifier, a standard for specifying the name and location of dataitems [49].2 The format of the results returned are documented as ContactsContract.RawContacts[6] and ContactsContract.Contacts [5], respectively.56