The maturity of smartphone security increasingly limits the possibilities of full filesystem acquisition so that alternative mechanisms need to be explored. We present an in-depth study of on-device data acquisition for Android, i.e., data acquisition based on a dedicated forensic acquisition app. To this end, we conduct a comprehensive analysis of data sources available to such apps on Android, these being mainly application interfaces of Android's content providers and system services. We find that none of the existing commercial and open-source on-device acquisition tools covers all data sources from our list. We therefore develop an acquisition app called ForensicEye and evaluate it with a comprehensive set of 23 real-world devices from various vendors. We show that, while commercial solutions often provide greater automation and employ proprietary techniques or exploits, ForensicEye successfully accesses data sources not covered by those tools. Moreover, depending on the version of Android, commonly used external acquisition methods through ADB expose only a subset of the OS interfaces accessible by our app.
Industrial Control Systems (ICS) are vulnerable to a wide range of cyber attacks. Remote attackers can interfere with control room's ability to monitor and control physical processes, impairing operational safety. To comprehend such attacks, digital forensics are essential to trace the impact and generate evidence, which includes a reconstruction of operator activities on the Human-Machine Interfaces (HMI). However, due to differences between office IT and operational technology (OT), established IT forensics cannot be directly applied. While newer ICS provide extensive server-side event logging for operational and security purposes, they capture client-side interactions at a high level, not covering further low-level data sources such as visualized process states and detailed HMI interactions (e.g., pushed buttons, displayed plant areas). To complement server-side logging, retrofit legacy ICS with security logging, and enable reconstruction of operator actions and views as well as cross-validation against server logs, we present a host-based forensic logging system FROHA for HMI clients that combines: (1) Graphics API hooking to capture rendered HMI content, (2) RAM memory scanning to track physical process variable changes, and (3) External event monitoring via Windows UI Automation APIs to track operator inputs such as mouse clicks and window interactions. By analyzing volatile data sources in conjunction with windows mechanisms to capture their related data, we establish a vendor-independent logging system which generates forensic audit logs regarding the operator's view and actions. We validate our approach by implementing and applying it to a virtualized live copy of a productive ABB 800xA Distributed Control System (DCS) operated by an energy supplier, demonstrating its applicability for forensic analysis in ICS environments.
Anti-forensics refers to techniques designed to obstruct forensic analysis. While such methods are increasingly used by cybercriminals, they also provide valuable insights for researchers by revealing weaknesses in forensic tools and thereby contributing to their robustness. Despite repeated attempts to define anti-forensics, the concept remains fragmented and inconsistently described across the literature. In addition, it raises ethical questions regarding appropriate research practices and, in some cases, the legitimacy of the field itself. This article examines the evolution of anti-forensics from a collection of technical challenges into an emerging research field and discusses key directions for its development over the next decade. Based on an analysis of 123 articles, we present insights into common techniques, attack vectors, and their distribution across forensic subdomains. Furthermore, we identify prevalent research methods in anti-forensics and counter-anti-forensics, along with their motivations and application contexts. Finally, we reflect on the implications of these findings for future research and propose directions towards a more coherent and ethically grounded understanding of anti-forensics.
System-centric memory forensics requires kernel-specific symbols and types, delaying analysis when no matching profile is available. Process-level dumps avoid full-system acquisition but typically omit OS-queryable context available only while the process is live. We present Memory Slice ( .msl ), a self-describing process-memory format that records captured pages together with module, region, file-descriptor, and network-connection metadata. It provides a three-state per-page acquisition model, hash-chain integrity, and optional authenticated encryption with post-quantum key encapsulation. The preserved metadata enables cross-session differential analysis across \(N{>}2\) independent executions. On TLS 1.3 keys from three libraries, the classifier achieves 100% recall while substantially reducing the search space. In a gocryptfs case study, it localizes the master key—using an analyst-supplied decryption oracle to verify candidates—and derives a memory pattern around it, and from that pattern we synthesize a Volatility 3 plugin that recovers the key from an independently acquired full-system image. We release the specification, MemSlicer , and MemDiver as open source.
