Namheun Son
Yunho Lee
Dohyun Kim
Joshua James (Digital Forensic Investigation Research Laboratory, Hallym University)
Sangjin Lee
Kyungho Lee

Abstract

At the time of this writing, Android devices are widely used, and many studies considering

methods of forensic acquisition of data from Android devices have been conducted.

Similarly, a diverse collection of smartphone forensic tools has also been introduced.

However, studies conducted thus far do not normally guarantee data integrity required for

digital forensic investigations. Therefore, this work uses a previously proposed method of

Android device acquisition utilizing ‘Recovery Mode’. This work evaluates Android Recovery

Mode variables that potentially compromise data integrity at the time of data acquisition.

Based on the conducted analysis, an Android data acquisition tool that ensures

the integrity of acquired data is developed, which is demonstrated in a case study to test

tool’s ability to preserve data integrity.