Forensic analysis and evaluation of file-wiping applications in Android OS

Area of Science:

• Digital Forensics
• Cybersecurity
• Mobile Computing

Background:

• Anti-forensic techniques, such as file-wiping, impede digital investigations.
• File-wiping aims to permanently destroy data by overwriting it.
• The effectiveness of file-wiping applications on Android remains largely unevaluated.

Purpose of the Study:

• To evaluate the anti-forensic effectiveness of file-wiping applications on Android.
• To identify vulnerabilities and non-compliance with standards in file-wiping tools.
• To develop a framework for detecting file-wiping traces on Android devices.

Main Methods:

• Selection and analysis of six file-wiping applications from the Google Play Store.
• Utilized reverse engineering and digital forensic tools for in-depth examination.
• Investigated Android OS and application artifacts generated during the wiping process.

Main Results:

• One application falsely advertised file-wiping, performing only file deletion.
• File-wiping applications demonstrated a lack of adherence to established standards.
• Evidence of tool execution and residual artifacts of wiped files were successfully identified.

Conclusions:

• File-wiping applications on Android present significant challenges and potential weaknesses for investigators.
• A novel evaluation framework was proposed to aid in detecting wiping activity and inferring deleted data.
• The findings enhance digital forensic capabilities in handling anti-forensic techniques on mobile devices.