Boyer-Moore Algorithm in Retrieving Deleted Short Message Service in Android Platform

10th International Conference Numerical Analysis in Engineering

数学;工业技术

Rahmat, R.F.^1 ; Prayoga, D.F.^1 ; Gunawan, D.^1 ; Sitompul, O.S.^1

Department of Information Technology, Faculty of Computer Science and Information Technology, Universitas Sumatera Utara, Medan, Indonesia^1

关键词: Android platforms;    Bit-deletions;    Boyer-Moore algorithms;    Digital evidence;    High-accuracy;    Mobile forensics;    Short message services;    String matching;   

Others  :  https://iopscience.iop.org/article/10.1088/1757-899X/308/1/012016/pdf
DOI  :  10.1088/1757-899X/308/1/012016

学科分类：工业工程学

来源: IOP

【 摘 要 】

Short message service (SMS) can be used as digital evidence of disclosure of crime because it can strengthen the charges against the offenders. Criminals use various ways to destroy the evidence, including by deleting SMS. On the Android OS, SMS is stored in a SQLite database file. Deletion of SMS data is not followed by bit deletion in memory so that it is possible to rediscover the deleted SMS. Based on this case, the mobile forensic needs to be done to rediscover the short message service. The proposed method in this study is Boyer-Moore algorithm for searching string matching. An auto finds feature is designed to rediscover the short message service by searching using a particular pattern to rematch a text with the result of the hex value conversion in the database file. The system will redisplay the message for each of a match. From all the testing results, the proposed method has quite a high accuracy in rediscovering the short message service using the used dataset. The search results to rediscover the deleted SMS depend on the possibility of overwriting process and the vacuum procedure on the database file.