Incorporating Mobile Forensics Into Nugget

Abstract

Mobile devices are a significant component in our daily lives. Their ability to be ubiquitous gives digital forensic investigators the ability to gain a deeper insight into cases they are investigating. The use of mobile devices in digital forensic investigations is on the rise due to the wealth of information they contain. To address the increasing heterogeneity of digital forensic tools, Stelly and Roussev (2018) came up with Nugget. Nugget is a digital forensics Domain Specific Language (DSL) that provides a formal and useful way to describe digital forensic computations that abstracts out their implementation. Nugget gives investigators the ability to declare forensic operations to perform on digital evidence without specifying how they are to be done. However, Nugget does not currently support mobile digital forensics. The objective of this study is to extend Nugget by enabling it to declare and execute mobile digital forensic computations. This was done by integrating available forensic tools with Nugget and extending Nugget’s DSL to accommodate mobile forensic computations. Keywords Nugget, mobile device forensics