Enhanced Forensic Framework For Rooted Mobile Phones And The Impact On User Data Integrity – A Case Of Android Smartphones

The proliferation of Android smartphones has propagated negative societal issues that resulted in successful arrests of the culprits, forensic examination and prosecution. Other such cases have collapsed due to alteration of forensic evidence as a result of inadequate forensic sound frameworks. The purpose of this study was to develop and evaluate an enhanced forensic framework for Android smartphones with a key focus on data integrity. The research objectives included exploration of rooting techniques and the impact on data integrity; exploration of forensic frameworks and development of an enhanced forensic framework; and lastly, extract, examine and analyze forensic data with the aim of validating the enhanced forensic framework. The research adopted a laboratory experiment using MOBILedit Forensic Express software to collect forensic data on three Android smartphones that were rooted using KingoRoot software. The research performed both logical and physical acquisitions in .rtf and .txt format; images in .jpeg; messages and web browsing history. Using hash values, analysis of both logical and physical copies was conducted to establish forensic data integrity issues. Through the enhanced framework, data integrity was maintained since both logical and physical copies of the report files presented the same data integrity characteristics. Research objective one acknowledged several rooting techniques that presented shortcomings such as risks of bricking smartphones. Using KingoRoot software, the rooting technique used in this research did not affect the test devices used and the final data, but only aided in retrieving more data in physical acquisition than in a logical acquisition. The enhanced forensic sound model designed and implemented in this research addressed objective two by ensuring that if the proposed steps were carried out, both logical and physical extractions of data provided comparative data that ensured data integrity. Extraction, examination and analysis of data was well conducted and fully addressed objective three of this research. Through calculation of the hash values, data integrity was ensured since all integrity characteristics presented similar values for the same document, image, message or browsing history in both logical and physical extraction reports. The enhanced framework was therefore validated. For future work, the research recommended the development of forensic tools that could be able to decrypt specific data such as WhatsApp conversations and other highly encrypted applications.