Skip to content

LogExtractor: Extracting Digital Evidence from Android Log Messages via String and Taint Analysis

Journal: Forensic Science International: Digital Investigation
Published: 2021
Primary Author: Chris Chao-Chun
Secondary Authors: Chen Shi, Neil Zhenqiang Gong, Yong Guan
Research Area: Digital

Mobile devices are increasingly involved in crimes. Therefore, digital evidence on mobile devices plays a more and more important role in crime investigations. Existing studies have designed tools to identify and/or extract digital evidence in the main memory or the file system of a mobile device. However, identifying and extracting digital evidence from the logging system of a mobile device is largely unexplored.

In this work, we aim to bridge this gap.Specifically, we design, prototype, and evaluate LogExtractor, the first tool to automatically identify and extract digital evidence from log messages on an Android device. Given a log message, LogExtractor first determines whether the log message contains a given type of evidentiary data (e.g., GPS coordinates) and then further extracts the value of the evidentiary data if the log message contains it.

Specifically, LogExtractor takes an offline-online approach. In the offline phase, LogExtractor builds an App Log Evidence Database (ALED) for a large number of apps via combining string and taint analysis to analyze the apps’ code. Specifically, each record in the ALED contains 1) the string pattern of a log message that an app may write to the logging system, 2) the types of evidentiary data that the log message includes, and 3) the segment(s) of the string pattern that contains the value of a certain type of evidentiary data, where we represent a string pattern using a deterministic finite-state automaton. In the online phase, given a log message from a suspect’s Android device, we match the log message against the string patterns in the ALED and extract evidentiary data from it if the matching succeeds. We evaluate LogExtractor on 65 benchmark apps from DroidBench and 12.1 K real-world apps. Our results show that a large number of apps write a diverse set of data to the logging system and LogExtractor can accurately extract them.

Related Resources

Likelihood ratios for categorical count data with applications in digital forensics

Likelihood ratios for categorical count data with applications in digital forensics

We consider the forensic context in which the goal is to assess whether two sets of observed data came from the same source or from different sources. In particular, we…
CSAFE Project Update & ASCLD FRC Collaboration

CSAFE Project Update & ASCLD FRC Collaboration

This presentation highlighted CSAFE’s collaboration with the ASCLD FRC Collaboration Hub.
Forensic Analysis on Android Social Networking Applications

Forensic Analysis on Android Social Networking Applications

This presentation is from the 75th Anniversary Conference of the American Academy of Forensic Sciences, Orlando, Florida, February 13-18, 2023. Posted with permission of CSAFE.
Source Camera Identification on Multi-Camera Phones

Source Camera Identification on Multi-Camera Phones

Camera identification addresses the scenario where an investigator has a questioned digital image from an unknown camera. The investigator wants to know whether the questioned image was taken by a…