Adding Continuous Proactive Forensics to Android

Abstract

Criminals and terrorists have become good at using the smartphones. The traditional reactive forensics responds only after an incident. Smartphone OS should include proactive forensics support (pfs), that deals with pre-incident preparation. We designed pfs for a custom Android ROM. All configured user activities are monitored stealthily, and opportunistically transferred to the cloud for further investigation. This includes SMS, call log, browser history, etc. We also add a keylogger and call tapping facility. We built two Android apps + a PC client that authenticates a forensics investigator and permits to browse, record, save the activities of the criminal user.