Building Tools for Forensic Analysis of Mobile and IoT Applications Using Selective Data Extraction

The amount of data stored on smart phones and other mobile devices has increased phenomenally over the last decade. As a result there has been a spike in the use of these devices for documenting different scenarios that are encountered by the users as they go about their daily lives. Smart phone data has also become a critical evidence in the court for several criminal cases. Forensic software tool developers are continually developing new techniques for the extraction of data from several smart phones. The two most common techniques are physical and logical extraction. Logical extraction is a technique for extracting the files and folders without any of the deleted data from a mobile device. For logical extraction, a software tool is used to make a copy of the files. Experienced examiners have to know how each of these devices and operating systems function, the many locations that data can be on each different device/OS, as well as how to access and work with all of that information in a forensically sound manner. This dissertation discusses about the multi-fold contributions we have made in order to improve forensic analysis and extraction of data from smart phones. In this dissertation, I have discussed various tools and systems that have been built for forensic analysis of mobile and IoT applications using selective data extraction, machine learning, classification techniques and inference engines.