Android APP Forensics: A Method to Address Extraction Challenges with Tools

As technology advances, mobile device forensics becomes increasingly challenging in the context of constantly updated operating systems and enhanced data encryption techniques. This paper, taking the TikTok application data extraction from a Huawei mobile phone in an actual case as an example, delves into the difficulty of extracting data from specific applications in new Android phones. To tackle this challenge, this study proposes a method utilizing a root-privileged phone to clone data from the source device and subsequently extract the required information, thereby achieving successful data retrieval. Furthermore, recognizing the inefficiencies and time-consuming nature of traditional manual timestamp conversion methods during targeted database analysis, this study has developed a novel database retrieval tool. This tool automates the process of swiftly retrieving and analyzing data from key time periods across multiple databases within a predefned directory, significantly enhancing processing speed and efficiency. Thus, our study not only offers a solution to the challenges of data extraction and analysis but also serves as a valuable methodological reference for mobile device forensics in similar cases.