[Paper Review] EviHunter: Identifying Digital Evidence in the Permanent Storage of Android Devices via Static Analysis

Chris Chao-Chun Cheng, Shi Chen+2 more|arXiv (Cornell University)|Aug 18, 2018

Advanced Malware Detection Techniques28 references4 citations

TL;DR

EviHunter is a static analysis tool that automatically identifies files on Android devices likely to contain digital evidence by pre-computing an App Evidence Database (AED) from app source code. It achieves high precision in detecting evidentiary data types—such as GPS locations, URLs, and text inputs—along with their corresponding file paths, outperforming keyword-based and manual methods in identifying relevant files across real-world apps.

ABSTRACT

Crimes, both physical and cyber, increasingly involve smartphones due to their ubiquity. Therefore, digital evidence on smartphones plays an increasingly important role in crime investigations. Digital evidence could reside in the memory and permanent storage of a smartphone. While we have witnessed significant progresses on memory forensics recently, identifying evidence in the permanent storage is still an underdeveloped research area. Most existing studies on permanent-storage forensics rely on manual analysis or keyword-based scanning of the permanent storage. Manual analysis is costly, while keyword matching often misses the evidentiary data that do not have interesting keywords. In this work, we develop a tool called EviHunter to automatically identify evidentiary data in the permanent storage of an Android device. There could be thousands of files on the permanent storage of a smartphone. A basic question a forensic investigator often faces is which files could store evidentiary data. EviHunter aims to answer this question. Our intuition is that the evidentiary data were produced by apps; and an app's code has rich information about the types of data the app may write to a permanent storage and the files the data are written to. Therefore, EviHunter first pre-computes an App Evidence Database (AED) via static analysis of a large number of apps. The AED includes the types of evidentiary data and files that store them for each app. Then, EviHunter matches the files on a smartphone's permanent storage against the AED to identify the files that could store evidentiary data. We evaluate EviHunter on benchmark apps and 8,690 real-world apps. Our results show that EviHunter can precisely identify both the types of evidentiary data and the files that store them.

Motivation & Objective

• To address the challenge of identifying relevant digital evidence files in Android's permanent storage, which is often overlooked in favor of memory forensics.
• To overcome the limitations of manual analysis and keyword-based scanning, which are time-consuming and prone to missing evidence without specific keywords.
• To develop an automated, scalable solution for forensic investigators to prioritize files likely to contain evidentiary data on Android devices.
• To leverage static analysis of app code to predict which files store sensitive data types such as locations, URLs, and user inputs.
• To build a comprehensive App Evidence Database (AED) that maps app behaviors to specific file paths and data types for rapid forensic matching.

Proposed method

• EviHunter employs an offline-online architecture: first, it constructs an App Evidence Database (AED) via static data flow analysis on a large corpus of Android apps.
• The AED captures file paths and associated evidentiary data types (e.g., location, URL, text input) by analyzing data flows from sources to file system sinks.
• It extends static analysis tools with custom tags that track both data type and file path, enabling precise identification of evidence-storing files.
• Propagation rules are designed to handle file path construction, including dynamic path generation via system APIs and component communication.
• The tool identifies new source methods for file paths and integrates data-flow summaries for commonly used Android framework APIs to improve accuracy.
• In the online phase, EviHunter matches file paths from a suspect device’s storage against the AED to flag files likely to contain digital evidence.

Experimental results

Research questions

• RQ1 Can static analysis of Android app code accurately predict which files on permanent storage may contain digital evidence such as GPS locations, URLs, or user inputs?
• RQ2 How effective is a pre-computed App Evidence Database (AED) in reducing the search space for forensic investigators compared to keyword-based or manual methods?
• RQ3 To what extent can static analysis with enhanced tagging and propagation rules detect evidentiary data in files that lack keyword indicators?
• RQ4 How scalable and precise is EviHunter when applied to real-world Android applications beyond benchmark apps?
• RQ5 Can the integration of file path tracking with data type tracking improve the precision of digital evidence identification in mobile forensics?

Key findings

• EviHunter successfully identifies both the types of evidentiary data and their corresponding file paths with high precision, enabling forensic investigators to focus on relevant files.
• The tool outperforms keyword-based scanning, which often misses evidence in files lacking specific keywords, as shown in prior studies.
• Evaluation on 8,690 real-world Android apps confirmed EviHunter’s ability to accurately map app behaviors to file system outputs.
• The App Evidence Database (AED) built via static analysis covers a wide range of evidentiary data types and file paths, demonstrating scalability to real-world apps.
• EviHunter’s approach reduces the need for manual file triage by narrowing down thousands of files to a manageable set of high-probability evidence files.
• The integration of file path tracking with data type propagation significantly improves detection accuracy over traditional security-focused static analysis tools.