A Repeatability- and Error-Centered Validation Protocol for MobileDevice Forensic Workflows
DOI:
https://doi.org/10.65879/3070-5789.2026.02.03Keywords:
Mobile Device Forensics, Forensic Workflow Validation, Repeatability, Reproducibility, Timestamp ReliabilityAbstract
Mobile device forensic reliability is highly dependent on device model, operating-system version, access state, extraction pathway, parser behavior, application version, and other workflow conditions. As a result, reliability should be demonstrated under defined and repeatable circumstances rather than inferred from tool identity alone. This paper presents a repeatability- and error-centered validation protocol for mobile device forensic workflows and illustrates its application through a bounded Android logical-acquisition pilot. The study is motivated by the growing need for practical validation methods that address configuration-specific evidence access, parser variability, frequent mobile application changes, cloud-linked artifacts, AI-assisted parsing workflows, and timestamp uncertainty in contemporary iOS and Android examinations. The proposed protocol adopts a controlled laboratory design based on documented ground truth, repeated acquisitions, fixed workflow conditions, explicit treatment of access-state constraints, and stage-based anomaly classification. It defines a compact measurement framework for artifact recovery, false positives, false negatives, timestamp deviation after justified normalization, repeatability across repeated runs, and reproducibility across independently repeated subsets. To demonstrate the reporting model, the paper includes a small scoped pilot using an unlocked Samsung Galaxy S8 and an ADB logical-acquisition workflow. Across three repeated runs, the pilot recovered all 35 scoped user-accessible artifacts and produced identical recovered artifact sets, while also showing the importance of bounding claims because timestamp-delta accuracy, app-private data, deleted artifacts, and cross-device generalization were outside the pilot scope. The main result of the paper is a disclosure-ready validation framework that links measured outcomes to the exact technical conditions under which they were produced. Rather than ranking commercial tools, the paper offers a reproducible framework for generating bounded, reviewable, and defensible validation records for mobile forensic workflows. The pilot is used only to demonstrate recovery and repeatability reporting; timestamp-delta validation remains part of the broader protocol and requires trusted creation-time records in a full deployment.
References
[1] Teufl P, Zefferer T, Stromberger C, Hechenblaikner C. iOS encryption systems: Deploying iOS devices in security-critical environments. In: 2013 International Conference on Security and Cryptography (SECRYPT). 2013. p. 1–13.
[2] Groß T, Ahmadova M, Müller T. Analyzing Android’s File-Based Encryption: Information Leakage through Unencrypted Metadata. In: Proceedings of the 14th International Conference on Availability, Reliability and Security [Internet]. New York, NY, USA: Association for Computing Machinery; 2019 [cited 2026 Mar 17]. p. 1–7. (ARES ’19). Available from: https://dl.acm.org/doi/10.1145/3339252.3340340
doi:10.1145/3339252.3340340
[3] Fukami A, Stoykova R, Geradts Z. A new model for forensic data extraction from encrypted mobile devices. Forensic Sci Int Digit Investig. 2021 Sep 1;38:301169.
doi:10.1016/j.fsidi.2021.301169
[4] Alshameri F, Khanta K, Boyce S. A comparison study to analyse the data acquisitions of iOS and android smartphones using multiple forensic tools. Int J Electron Secur Digit Forensics. 2024 Jan;16(3):267–83.
doi:10.1504/IJESDF.2024.138325
[5] Claij-Swart AA, Oudsen E, Timbermont B, Hargreaves C, Voigt LL. Automatically generating digital forensic reference data triggered by mobile application updates. Forensic Sci Int Digit Investig. 2025 Oct 1;DFRWS APAC 2025 - Selected Papers from the 5th Annual Digital Forensics Research Conference APAC54:301985.
doi:10.1016/j.fsidi.2025.301985
[6] Stoykova R, Franke K. Reliability validation enabling framework (RVEF) for digital forensics in criminal investigations. Forensic Sci Int Digit Investig. 2023 Jun 1;45:301554.
doi:10.1016/j.fsidi.2023.301554
[7] Baggili I, Mislan R, Rogers M. Mobile Phone Forensics Tool Testing: A Database Driven Approach. Electr Comput Eng Comput Sci Fac Publ. 2007 Jan 1.
[8] Saleem S, Popov O, Appiah-Kubi OK. Evaluating and Comparing Tools for Mobile Device Forensics Using Quantitative Analysis. In: Rogers M, Seigfried-Spellar KC, editors. Digital Forensics and Cyber Crime. Berlin, Heidelberg: Springer; 2013. p. 264–82.
doi:10.1007/978-3-642-39891-9_17
[9] Anobah M, Saleem S, Popov O. Testing Framework for Mobile Device Forensics Tools. J Digit Forensics Secur Law. 2014 Jan 1;9(2).
doi:10.15394/jdfsl.2014.1183
[10] Scurich N, Faigman DL, Albright TD. Scientific guidelines for evaluating the validity of forensic feature-comparison methods. Proc Natl Acad Sci. 2023 Oct 10;120(41):e2301843120.
doi:10.1073/pnas.2301843120
[11] Stoykova R. Digital evidence: Unaddressed threats to fairness and the presumption of innocence. Comput Law Secur Rev. 2021 Sep 1;42:105575. doi:10.1016/j.clsr.2021.105575
[12] Horsman G. Sources of error in digital forensics. Forensic Sci Int Digit Investig. 2024 Mar 1;48:301693. doi:10.1016/j.fsidi.2024.301693
[13] Schatz B, Mohay G, Clark A. A correlation method for establishing provenance of timestamps in digital evidence. Digit Investig. 2006 Sep 1;The Proceedings of the 6th Annual Digital Forensic Research Workshop (DFRWS ’06)3:98–107.
doi:10.1016/j.diin.2006.06.009
[14] Vanini C, Hargreaves CJ, van Beek H, Breitinger F. Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction. Forensic Sci Int Digit Investig. 2024 Jul 1;DFRWS USA 2024 - Selected Papers from the 24th Annual Digital Forensics Research Conference USA49:301759. doi:10.1016/j.fsidi.2024.301759
[15] Aagaard P, Dinyarian B, Abduljabbar O, Choo KKR. Family locating sharing app forensics: Life360 as a case study. Forensic Sci Int Digit Investig. 2023 Mar 1;44:301478.
doi:10.1016/j.fsidi.2022.301478
[16] Hargreaves C, Nelson A, Casey E. An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis. Forensic Sci Int Digit Investig. 2024 Mar 1;DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe48:301679.
doi:10.1016/j.fsidi.2023.301679
[17] Losavio M, Wilson D, Elmaghraby A. Prevalence, Use, and Evidentiary Issues of Digital Evidence of Cellular Telephone Consumer and Small-Scale Digital Devices. J Digit Forensic Pract. 2007 Jun 22;1(4):291–6.
doi:10.1080/15567280701418080
[18] Stoykova R, Andersen S, Franke K, Axelsson S. Reliability assessment of digital forensic investigations in the Norwegian police. Forensic Sci Int Digit Investig. 2022 Mar 1;40:301351.
doi:10.1016/j.fsidi.2022.301351
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Younghun Chae, Angela Guercio, Timothy Arndt (Author)
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
