Forensic collection and analysis of thumbnails in android
Date
2015
Authors
Di Leom, M.
D'Orazio, C.J.
Deegan, G.
Choo, K.K.R.
Editors
Advisors
Journal Title
Journal ISSN
Volume Title
Type:
Conference paper
Citation
IEEE TrustCom-15, 2015, vol.1, iss.7345391, pp.1059-1066
Statement of Responsibility
Conference Name
IEEE International Conference on Trust, Security and Privacy in Computing & Communications (20 Aug 2015 - 22 Aug 2015 : Helsinki, Finland)
Abstract
JPEG thumbnail images are of interest in forensic investigations as images from the thumbnail cache could be intact even when the original pictures have been deleted. In addition, a deleted thumbnail is less likely to be fragmented due to its small size. The focus of existing literature is generally on the desktop environment. Considering the increasing capability of smart mobile devices, particularly Android devices, to take pictures and videos on the go, it is important to understand how thumbnail scan be collected from these devices. In this paper, we examine and describe the various thumbnail sources in Android devices and propose a methodology for thumbnail collection and analysis from Android devices. We also demonstrate the utility of our proposed methodology using a case study (e.g. thumbnails could be recovered even when the file system is heavily fragmented). Our findings also indicate that collective information obtained from the recovered fragmented JPEG image (e.g. metadata) and the thumbnail could be akin to recovering the full image for forensic purposes.
School/Discipline
Dissertation Note
Provenance
Description
Access Status
Rights
Copyright 2015 IEEE