2026-10-14T05:50:01Z https://api.figshare.com/v2/oai

oai:figshare.com:article/34021953 2026-10-06T03:22:27Z category_28990 category_28924 portal_947 item_type_14 month_year_10_2026

Chameleon Forensics (Android): Assume Adversarial Logical Extraction Forensic Tool Joseph Lim (6188483) Vivek Balachandran (10758771) Mobile computing Cybersecurity and privacy not elsewhere classified mobile security Existing Android forensic acquisition tools perform well at gaining access to devices and acquiring forensic data when the device behaves as expected. However, what if the device is intentionally modified to detect and disrupt forensic extraction attempts? Anti-forensic techniques can interfere with commonly implemented acquisition methods such as ADB-based extraction or forensic agent deployment, potentially preventing investigators from successfully collecting forensic data. This work builds upon the mobile device forensic acquisition process outlined in NIST SP 800-101 Revision 1. Extending this framework, the proposed approach introduces two additional considerations for Android forensic acquisition in potentially adversarial environments. First, it incorporates a pre-acquisition triage step aimed at helping examiners quickly identify suspicious applications on the device that may interfere with forensic acquisition. Second, it proposes that acquisition workflows should be adversarial-aware, designed in a manner to improve the reliability of forensic evidence collection when anti-forensic mechanisms may be present on the device. The resulting tool introduces an Android logical acquisition tool that assumes the target device may be adversarially modified to disrupt forensic acquisition through known anti-forensic mechanisms. By integrating pre-acquisition triage with adversarial-aware acquisition strategies, Chameleon Forensics aims to support more reliable forensic evidence collection in environments where traditional acquisition assumptions may not hold. 2026-08-01T00:00:00Z Text Conference contribution 10.25447/sit.34021953.v1 https://figshare.com/articles/conference_contribution/Chameleon_Forensics_Android_Assume_Adversarial_Logical_Extraction_Forensic_Tool/34021953 In Copyright