A carregar...
Publicação
Digital forensic artifacts of the Your Phone application in Windows 10
Orientador(es)
Resumo(s)
Your Phone is a Microsoft system that comprises two applications: a smartphone app for Android 7 + smartphones and a desktop application for Windows 10/18.03+. It allows users to access their most recent smartphone-stored photos/screenshots and send/receive short message service (SMS) and multimedia messaging service (MMS) within their Your Phone-linked Windows 10 personal computers. In this paper, we analyze the digital forensic artifacts created at Windows 10 personal computers whose users have the Your Phone system installed and activated. Our results show that besides the most recent 25 photos/screenshots and the content of the last 30-day of sent/received SMS/MMS, the contact database of the linked smartphone(s) is available in a accessible SQLite3 database kept at the Windows 10 system. This way, when the linked smartphone cannot be forensically analyzed, data gathered through the Your Phone artifacts may constitute a valuable digital forensic asset. Furthermore, to explore and export the main data of the Your Phone database as well as recoverable deleted data, a set of python scripts – Your Phone Analyzer (YPA) – is presented. YPA is available wrapped within an Autopsy module to assist digital practitioners to extract the main artifacts from the Your Phone system.
Descrição
Palavras-chave
SMS Photos Phone contacts Smartphone Digital forensic Windows 10
Contexto Educativo
Citação
Patricio Domingues, Miguel Frade, Luis Miguel Andrade, João Victor Silva, Digital forensic artifacts of the Your Phone application in Windows 10, Digital Investigation, Volume 30, 2019, Pages 32-42, ISSN 1742-2876, https://doi.org/10.1016/j.diin.2019.06.003.
Editora
Elsevier BV