dissertation

operating system components, but this also allows a forensics tool to accessdatabase files directly in the phone’s file system instead of going through acontent provider.SELinux [86] is an initiative from the US National Security Agency toimplement mandatory access control on Linux. It has been included in standardLinux since 2003 [93], and has been used by major desktop distributionssuch as Fedora [22] and Ubuntu [36] for several years.SEAndroid [31] is a project for using SELinux on Android. While using itwould require that the phone first be rooted to replace the operating systemwith one implementing SEAndroid, once running it would be able to restricteven the root user from certain actions. It would then be possible to forbidforensic tools from reading database files from the file system, thereby forcingthem to go through the content provider to get the data.7.6 Data destructionThe modifications performed for this dissertation were all non-destructive,meaning that the original data was still left on the phone, even when it wasnot presented to the forensics tools. However, this is not inherent in the design.The improved hiding and triggering properties found by implementinganti-forensics in the operating system over using a standalone applicationwould also be able to hide destructive anti-forensics routines. For example,the package manager could be extended to not only reject the installationof forensics tools, but use the installation attempt as a trigger to perform acomplete wipe of the phone. This would free the anti-forensics routines fromthe timing constraints which apply when they run as a separate application.59