Inside Job: The Methods, Challenges, and Opportunities for On-Device Data Acquisition on Android

The maturity of smartphone security increasingly limits the possibilities of full filesystem acquisition so that alternative mechanisms need to be explored. We present an in-depth study of on-device data acquisition for Android, i.e., data acquisition based on a dedicated forensic acquisition app. To this end, we conduct a comprehensive analysis of data sources available to such apps on Android, these being mainly application interfaces of Android's content providers and system services. We find that none of the existing commercial and open-source on-device acquisition tools covers all data sources from our list. We therefore develop an acquisition app called ForensicEye and evaluate it with a comprehensive set of 23 real-world devices from various vendors. We show that, while commercial solutions often provide greater automation and employ proprietary techniques or exploits, ForensicEye successfully accesses data sources not covered by those tools. Moreover, depending on the version of Android, commonly used external acquisition methods through ADB expose only a subset of the OS interfaces accessible by our app.