Open Source Android Cache Viewer Prototype

1.11.1cache_r.0

Figure 9 - cache_r.0 Details

Figure 10 - cache_r.0 Data

When cache_r.0 is opened, it lists all items as a tab, and each tab contains a details section and a data section. The details section lists the record values and the data displays the actual data. If the data is an image, the picture is displayed.

1.11.2WebView Cache

Figure 11 - WebView Cache Index

Figure 12 - WebView Cache Data

Figure 13 - WebView Cache External Data

WebView caches are displayed according to the internal data structure and their linked external files. If the data is an image or a text file, it is displayed as such.

1.11.3YouTube Cache

Figure 14 - YouTube Cache

1.11.4Android Image Gallery Cache

Figure 15 - Android Image Gallery

1.11.5SQLite DB Cache

The tool is capable of displaying all tables if the cache is a SQLite database.

Figure 16 - SQLite DB Cache

1.11.6Unknown Cache

When caches are unknown or unable to identify, the tool displays only the ASCII text in them and replaces the non-printable character with a dot.

Figure 17 - Unknown Cache

Conclusion and Future Work

Android is the world’s most popular mobile platform with more than a million new device activations every day, according to Android Developer website. Google Play also has more than 1.2 million apps as of April 2014 . Mobile digital forensics, particularly for Android is a rapidly expanding field.

1.12Research Summary

In this thesis, we have contributed towards a better understanding to both research questions identified in Chapter 1.2, as explained below.

1. 
   What is the process or methodology that must be followed to forensically analyse Android caches?
   

In the thesis, we identified literature gaps and limitations in using existing forensic models when examining Android caches. To assist forensic researchers and practitioners in examining the wide range of caches used by various Android Apps, a taxonomy for Android caches and the conceptual Android Cache Forensics Model were proposed – see Chapter 3. We then studied more than 100 popular apps (i.e. apps that have more than a million downloads or an app from a popular brand). Using the Android Cache Forensics Model, we found that 11 apps appear to be using some form of cache. These 11 apps were then studied in detail. Previously unknown cache formats were decoded and several undocumented cache formats used commonly by Android apps were documented – see Chapter 4.

2. 
   How can we make use of a forensically sound process to build new tools and utilities to analyse unknown and undocumented cache file formats?
   

Based on findings from Chapter 4, we designed Android Cache Viewer, an open source prototype tool, to decode Android cache formats, such as WebViewComponent Cache, SQLite DB cache, Image gallery cache, Serialized Object cache and DiskLruCache. We demonstrate in Chapter 4.3 that the viewer can assist forensic investigators and law enforcement in analysing undocumented Android cache formats with ease.

1.13Future Work

Much work in this area remains to be done. For example, a potential extension of this thesis is to add additional plugins for other undocumented cache file structures, adding new cache formats as new formats are introduced and making each plugin as independently loadable modules. The source code for Android Cache Viewer prototype is uploaded to GitHub (https://github.com/fcidau/Android-Cache-Viewer) and released under MIT License for collaborative further development by the open source community.

Directory: wki -> images
images -> Research Proposal Augmented Reality Visualization of Outdoor Environmental Corrosion

Download 0.49 Mb.

Share with your friends: