Forensic collection and analysis of thumbnails in android

Proceedings - 14th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2015

Volumn 1, Issue , 2015, Pages 1059-1066

  Di Leom, Ming ^a   D'Orazio, Christian Javier ^a   Deegan, Gaye ^a   Choo, Kim Kwang Raymond ^a  

^a UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

Author keywords

Android forensics; Forensic recovery; Mobile forensics; Thumbcache; Thumbnail recovery

Indexed keywords

MOBILE DEVICES; RECOVERY;

ANDROID FORENSICS; DESKTOP ENVIRONMENT; FILE SYSTEMS; FORENSIC INVESTIGATION; FORENSIC RECOVERIES; JPEG IMAGE; MOBILE FORENSICS; THUMBCACHE;

ANDROID (OPERATING SYSTEM);

EID: 84967194749     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/Trustcom.2015.483     Document Type: Conference Paper

References (33)

1. D. Quick, C. Tassone, &K.-K.R. Choo, "Forensic analysis of windows thumbcache files," in 20th Americas Conf. Inform. Syst., Association for Inform. Syst., 2014
2. Matt 2012, Analyzing thumbcache [Online]. Available: http://escforensics.blogspot.com/2012/11/analyzing-thumbcache.html
3. D. Hurlbut 2005, Thumbs DB files forensic issues [Online]. Available: http://repo.zenksecurity. com/Techniques%20d.attaques%20%20.%20%20Failles/THU MBS%20DB%20FILES%20FORENSIC%20ISSUES.pdf
4. AccessData Forensic toolkit [Online]. Available: http://accessdata.com/solutions/digital-forensics/forensic-toolkit-ftk
5. H. Parsonage, 2012, Under my thumbs-revisiting windows thumbnail databases and some new revelations about the forensic implications [Online]. Available: http://computerforensics.parsonage.co.uk/downloads/UnderMyThumbs. pdf
6. S.L.A. Morris, "An investigation into the identification, reconstruction, and evidential value of thumbnail cache file fragments in unallocated space," Ph.D. thesis, Cranfield Univ., Shrivenham, Oxfordshire, UK, 2013.
7. A. Hoog, Android forensics: Investigation, analysis and mobile security for google android, Syngress, Boston, 2011.
8. R. Siciliano, 2012, I found your data on that used device you sold [Online]. Available: https://blogs.mcafee.com/consumer/i-found-yourdata-on-that-used-device-you-sold
9. M. Honan, 2013, Break out a hammer: You'll never believe the data 'wiped' smartphones store [Online]. Available: http://www.wired.com/2013/04/smartphone-data-trail
10. The Guardian 2013, Recycled mobile phones retain previous owner data [Online]. Available: http://web.archive.org/web/20140529182505/http://www.theguardian.co m/media-network/partner-zone-infosecurity/mobile-phones-previousowner-data [archived].
11. R. Schwamm, "Effectiveness of the factory reset on a mobile device," M.S. thesis, Naval Postgraduate School, Monterey, CA, USA, 2014.
12. J. McColgan, 2014, Tens of thousands of americans sell themselves online every day [Online]. Available: https://blog.avast.com/2014/07/08/tens-of-thousands-of-americans-sellthemselves-online-every-day/.
13. L. Simon and R. Anderson, "Security Analysis of Android Factory Resets," 4th Mobile Security Technologies Workshop, 2015.
14. S. Morris, &H. Chivers, "An analysis of the structure and behaviour of the windows 7 operating system thumbnail cache", in Proc. 1st Cyberforensics Conf., Univ. Strathclyde, Glasgow, UK, 2011.
15. T. Vidas, C. Zhang, &N. Christin, "Toward a general collection methodology for android devices", Digital Investigation, vol. 8, pp. S14-S24, 2011.
16. R. McKemmish, 'What is forensic computing?', Trends and Issues in Crime and Criminal Justice, 118, pp. 1-6, 1999.
17. Wartickler 2012, [GUIDE] internal memory data recovery-yes we can! [Online]. Available: http://www.xda-developers.com/android/restoregalaxy-nexus-internal-memory-after-bootloader-unlock-wipe
18. S. Stericson, 2015, BusyBox [Online]. Available: https://play.google.com/store/apps/details?id=stericson.busybox
19. Oxygen Forensics Oxygen forensic® suite [Online]. Available: http://www.oxygen-forensic.com/en/products/oxygen-forensicsuite/ features.
20. W. Pond, 2004, Netcat (windows) [Online]. Available: http://www.securityfocus.com/tools/139
21. M. Hörz, 2009, HxD-freeware hex editor and disk editor, viewed 13 August 2014, http://mh-nexus.de/en/hxd
22. machn1k Scalpel-2.0, viewed 15 August 2014, https://github.com/machn1k/Scalpel-2.0
23. P. Harvey, 2014, Exiftool, viewed 16 August 2014, http://owl.phy.queensu.ca/~phil/exiftool
24. Google, Factory images for nexus devices, viewed 11 August 2014, https://developers.google.com/android/nexus/images
25. E. Kutcher, 2014a, Thumbcache viewer [Online]. Available: https://code.google.com/p/thumbcache-viewer
26. E. Kutcher, 2014b, Thumbs viewer [Online]. Available: https://code.google.com/p/thumbs-viewer
27. T. Tachibanaya, 1999, Description of exif file format [Online]. Available: http://www.media.mit.edu/pia/Research/deepview/exif.html
28. H. Hillman, C. Hooper, &K.-K.R. Choo, "Online child exploitation: Challenges and future research directions", Computer Law and Security Review, vol. 30, no. 6, pp. 687-698, 2014.
29. E. Kee &H. Farid, "Digital image authentication from thumbnails," in Proc. SPIE Media Forensics Security II, SPIE Press, pp. 75410E-1-75410E-10, 2010.
30. S.J. Murdoch &M. Dornseif, "Hidden data in internet published documents," in 21st Chaos Commun. Congr., Chaos Computer Club, 2004.
31. Google 2014, Google+ for android [Online]. Available: https://play.google.com/store/apps/details?id=com.google.android.apps. plus
32. H. Guo &M. Xu, "A method for recovering JPEG files based on thumbnail," in Int. Conf. Control, Autom. and Syst. Eng., WASET, pp. 1-4, 2011.
33. S.L. Garfinkel, "Carving contiguous and fragmented files with fast object validation", Digital Investigation, vol. 4, Suppl. issue, pp. S2-S12, 2007.