Skip to main content
Article
A comparison of forensic acquisition techniques for android devices: A case study investigation of orweb browsing sessions
2014 6th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2014 Conference and Workshops
  • Nedaa Al Barghouthy, University of Sharjah
  • Andrew Marrington, Zayed University
Document Type
Conference Proceeding
Publication Date
1-1-2014
Abstract

The issue of whether to "root" a small scale digital device in order to be able to execute acquisition tools with kernel-level privileges is a vexing one. In the early research literature about Android forensics, and in the commercial forensic tools alike, the common wisdom was that "rooting" the device modified its memory only minimally, and enabled more complete acquisition of digital evidence, and thus was, on balance, an acceptable procedure. This wisdom has been subsequently challenged, and alternative approaches to complete acquisition without "rooting" the device have been proposed. In this work, we address the issue of forensic acquisition techniques for Android devices through a case study we conducted to reconstruct browser sessions carried out using the Orweb private web browser. Orweb is an Android browser which uses Onion Routing to anonymize web traffic, and which records no browsing history. Physical and logical examinations were performed on both rooted and non-rooted Samsung Galaxy S2 smartphones running Android 4.1.1. The results indicate that for investigations of Orweb browsing history, there is no advantage to rooting the device. We conclude that, at least for similar investigations, rooting the device is unnecessary and thus should be avoided. © 2014 IEEE.

ISBN
9781479932238
Publisher
IEEE Computer Society
Disciplines
Keywords
  • acquisition,
  • Android,
  • Orweb,
  • root,
  • rooting
Scopus ID
84901451626
Indexed in Scopus
Yes
Open Access
No
https://doi.org/10.1109/NTMS.2014.6813993
Citation Information
Nedaa Al Barghouthy and Andrew Marrington. "A comparison of forensic acquisition techniques for android devices: A case study investigation of orweb browsing sessions" 2014 6th International Conference on New Technologies, Mobility and Security - Proceedings of NTMS 2014 Conference and Workshops (2014) - 4
Available at: http://works.bepress.com/andrew-marrington/18/