Enhanced Forensic Process for Improving Mobile Cloud Traceability in Cloud-Based Mobile Applications

Recently, the rapid popularity of smart phones significantly impacts the day-to-day activities of humans due to the increased access to social media and instant messaging services. The misuse of social media services leads to different cybercrime activities. Both the mobile device and cloud are the most significant evidential sources for the social network application forensics. It is essential to establish a mobile cloud forensic process to deal with the crime activities performed by the intelligent mobile user. Also, improving the cloud event traceability is a challenging task in a massive cloud environment. This work presents a mobile cloud forensic process that incorporates the time synchronization and inter and intra-application analysis along with the traditional forensic procedure. Time synchronization is a prerequisite process that facilitates the investigator to perform the application forensics in the mobile cloud concisely. An inter and intra-application analysis process ensures the extraction of the forensic-rich evidence and enriches the performance of the cloud event traceability by utilizing the metadata of potential mobile evidence. The proposed forensic process maintains a chronological timeline of evidence before correlating the potential evidence of the mobile and cloud. Eventually, it submits the extracted evidence with a chain of custody information to validate the forensic investigation process. It significantly enhances the accuracy of the investigation and produces evidence by applying the step by step process in the Android WeChat social network application. (C) 2020 The Authors. Published by Elsevier B.V.