A methodology for live forensic acquisition in secure domain based on domain separation technology

Abstract

Smart devices, including smart phone and tablet, with easy Internet accessibility, mobility and usability are changing various service environment such as mobile office, smart work, mobile finance, e-government and so on. Recently, those mobile services have trusted execution environments to enhance reliability and security for secure application or preserving sensitive information that should be protected against malicious attacks. In order to overcome cyber threats or vulnerability, domain separation technology has emerged. However, the mobile device to which a domain separation technology has been applied, conventional digital evidence collection tools, based on the general domain, cannot be accessed from the isolated secure domain, furthermore, collecting digital evidence may be impossible. Therefore, this paper describes to a methodology of providing a forensic acquisition in a domain separation-based mobile device and, more particularly, to an apparatus and method that, in order for an investigator to collect digital evidence in the secure domain of a target mobile device.