Samma data – olika resultat : En jämförelse mellan kommersiella och open source-forensiska verktyg

Sammanfattning

This study examines how different forensics tools for Mobil data extraction differ whenit comes to amount, type and interpretation of extracted data. The purpose is to comparehow the tools Autopsy and Magnet AXIOM manage an analysis of the same forensicsimage from an Android phone in a controlled experiment. The study is built upon anexperimental method where a test phone with self-generated user data is being analyzedwith respective tools under the same conditions, where only the analysis tool varies.This study also consists of a fixed dataset from an iOS-image as a complement to ourmain study, where the same experiment done on our Android device has been conductedon an image that already has a fixed dataset.The results shows that there are some clear differences between the tools when it comesto the amount of data being extracted and what type of artefacts that are found. Someartefacts can be found in both tools, while some can only be identified by a single tool.The differences were also observed in how metadata and timestamps were interpretedand how the information was structured and presented.The conclusion is that the choice of what forensic tool you choose has a direct effect onthe analysis results, which in turn affects reproducibility and interpretation in digitalinvestigations. This study contributes to greater understanding of the tools limitationsand the importance of correct method choice in Mobil forensics.