SQLite Database Forensic Analysis of an Android Device

Pametni mobilni telefoni danas čine osnovu mnogih ljudskih djelatnosti i aktivnosti. Posljedica toga je kreiranje velike količine podataka. Podaci su često privatne prirode te sadrže osjetljive korisničke informacije. Zbog toga je vrijednost podataka danas veća nego ikad prije. Takav trend pogoduje razvoju digitalne forenzičke analize kao posebne grane forenzičke znanosti. Često su podaci dobiveni metodama forenzičke analize neprocjenjiv izvor dokaza u postupcima kaznenih istraga. U diplomskom radu je obavljen postupak ekstrakcije podataka Android pametnog mobilnog telefona. Također, postupak je povezan s internom SQLite bazom podataka u fazi analize. Teorijsku podlogu čini opis interne arhitekture SQLite baze podataka. Osim toga, navedeni su postupci i metodologije procesa forenzičke analize. Cilj diplomskog rada je dobivanje uvida u osnovne mogućnosti Andriller i Autopsy forenzičkih alata te SQLite baze podataka na primjeru prosječnog korisnika.Smartphones today make the basis of many human activities. The consequence is the creation of a large amount of data. The data is often private in nature and contains sensitive user information. As a result, the value of data is higher today than ever before. Such a trend favors the development of digital forensic analysis as a special branch of forensic science. Often, data obtained by forensic analysis methods are an invaluable source of evidence in criminal investigation proceedings. In this graduate thesis, the data extraction procedure of an Android smartphone was performed. Also, the process is linked to the internal SQLite database in the analysis phase. The theoretical basis is a description of the internal architecture of the SQLite database. In addition, the procedures and methodologies of the forensic analysis process are listed. The aim of the graduate thesis is to gain insight into the basic capabilities of Andriller and Autopsy forensic tools and SQLite database on the example of the average user