Purple computer monitor icon displaying binary code made of ones and zeros on a light background.

Conference/Workshop:
Advances in Digital Forensics XIX. Digital Forensics 2023.

Journal: IFIP Advances in Information and Communication Technology,

Published: 2023

Primary Author: Chris Chao-Chun Cheng

Secondary Authors: Li Lin, Chen Shi, Yong Guan

Type: Conference Proceeding, Publication

Research Area: Digital

One of significant mobile app forensic analysis problems is the app evidence extraction from the device. Given the fact that mobile apps could generate more than 19K files in a device [6], simply manually inspecting every file is time consuming and may miss critical piece of evidence. A recent forensic analysis study [38] shows that fuzzing tools (a.k.a. fuzzer), which programmatically produce interactions with mobile apps, can be helpful when they are paired with sandbox environments for studying the app’s runtime forensic behaviors, by which forensic practitioners summarize the patterns of evidential data (such as GPS coordinates) that could greatly help with future forensic investigation. However, we found there is no study of how reliable do fuzzing tools help with improving the efficiency of mobile app forensic analysis.We, therefore, propose AFuzzShield, which aims at verifying the mobile app program coverage under the scenario when the app has the anti-fuzzing technologies applied. By analyzing the runtime information of mobile app interaction traces, it can prevent real-world apps from being exercised by fuzzers and minimizes the overhead of human usages. Our proposed approach exploits a statistical model to distinguish the difference between fuzzer and human patterns, and therefore it does not require graphical user interface (GUI) injections and is compatible with any real-world apps with touchable/clickable GUIs. We evaluate AFuzzShield on apps from AndroTest, a popular benchmark app dataset for testing various fuzzers, and the results demonstrate that, the mobile app program coverage can be significantly affected when it has anti-fuzzing technique, AFuzzShield, deployed, which results in missing mobile app evidential data patterns in the analysis (e.g. 70% of apps show promising results when having AFuzzShield applied under Monkey).

View Full Article

Related Resources

A thick gray wavy line forming an abstract, looping shape on a light gray background.

An Introduction to the Forensic Handwriting Analysis Software handwriter

July 18, 2025

Full Article

Blue shoeprint with a tread pattern on a white background.

Forensic Footwear: A Retrospective of the Development of the MANTIS Shoe Scanning System

July 10, 2025

There currently are no shoe-scanning devices developed in the United States that can operate in a real-world, variable-weather environment in …

Full Article

A green fingerprint icon on a light gray background.

Examiner consistency in perceptions of fingerprint minutia rarity

July 10, 2025

Friction ridge examiners (FREs) identify distinctive features (minutiae) in fingerprints and consider how rare these observed minutiae are in their …

Full Article