MobDedup: Mobile data deduplication for enhancing digital forensics

Smartphones provide crucial but duplicate information in forensic investigations. The major deduplication tools designed for the cloud ignore constraints on phone storage, power, data fragmentation, and dynamic handling, leading to processing delays and limiting their efficient use. It also affects evidence integrity and increases the potential risk of data leakage. This paper proposes a data deduplication technique for resource-constrained Android devices with limited computing power and memory. The use of the Blake2b-Hash Algorithm in the proposed deduplication algorithm reduces overhead and enables dynamic memory allocation. Multiple strategies were proposed and tested using a wide range of Smartphones. The proposed algorithm is validated based on file analysis time, device storage and memory utilization, and storage overhead. The paper also assesses the hash function's cryptographic robustness. The experimental analysis demonstrates that the proposed method achieved a 45.90% processing time to identify 29.52% duplicate files. A 48.55% reduction in storage space was achieved, and battery consumption was reduced to 81.15% compared to MD5 and SHA224. It achieved up to 52.71% RAM optimization, along with only 0.0033% storage overhead to maintain the metadata of deleted files for forensic purposes. This proves the effectiveness and reliability of the proposed solutions in facilitating digital forensic analysis.