dissertation

ile phones are highly integrated and built from non-standard components,running software which is often proprietary, undocumented and frequentlychanged. To perform a similar component-by-component analysis, the analystwould start by disassembling the phone and removing the surfacemountedmemory chips, which is a delicate procedure with a high risk ofdamage. The memory chips can be read by standardised readers, but theinterpretation of the data depends on the software which was running on thephone.A much easier method is to let the phone run, and access the data throughthe normal interfaces provided by the software. This presents a high risk ofdata being modified, both as a normal function of the phone and by specialisedanti-forensic applications. However, the savings in time and effortare great enough that this method is endorsed by both ACPO and the AmericanNational Institute of Standards and Technology [63].Because of this, forensic analysts rely on the correct functioning of thephone’s software when performing analyses. This means that changing thatfunctionality is a way of thwarting analysis. Smartphones running operatingsystems such as Android and iOS are designed to allow the installationof third-party applications, so such applications with anti-forensic purposeshave been developed [51, 46, 68, 83]. By being regular applications, such antiforensicsystems have to work under the restrictions imposed by the system,such as application isolation and responsiveness demands. If anti-forensicmodifications were to be made on a lower level, these restrictions would notapply in the same way, possibly making more advanced methods available.This project investigates the viability of operating system-level anti-forensicsfor Android smartphones.The rest of this dissertation is structured as follows. Chapter 2 providesan overview of previous work in the field of Android anti-forensics. Chapter3 describes some details of the Android system relevant to the implementedanti-forensic system. The methodology is described in chapter 4, and theimplementation, testing and results in chapter 5. Conclusions are in chapter6, with suggestions for future work in chapter 7. Appendix A describesthe software and hardware used. Logs of query behaviour exhibited by the2