Digital Forensics Article Review: iOS, Android, and AirPrint Analysis

This report reviews three articles focusing on digital forensics of mobile devices. The first article examines the forensic applicability of Apple's iOS devices, particularly concerning the AirPrint feature and its potential for data recovery even within encrypted documents. The second article investigates the challenges of data processing in smartphones, especially those using encryption like the IMO app, exploring artifacts from both devices and network traffic on Android and iOS platforms, including a focus on network traffic analysis. The third article delves into the AirPrint feature itself, detailing its operational mode, technical aspects, and data recoverability, including recovery of metadata and data, and discusses forensic traces left by AirPrint in iOS devices. The report highlights the significance of mobile forensics in the context of digital investigations and the importance of understanding encryption and data recovery techniques in the analysis of mobile devices.

Running head: ARTICLE REVEIW
ARTICLE REVIEW
Name of the Student
Name of the University
Author note

2
ARTICLE REVEIW
ARTICLE 1
1-main area : After apple brought in market its flagship products iPhone and iPad, it brought
immense success for apple as a company and these products were a commercial success.
Consumers not only loved these products, but they were super proud in owning these devices.
However, applicability of these devices in forensic aspect was not recognized.
2-proposed solution: These devices contained type of data that were capable of providing insight
regarding forensic applications. These devices being portable was also capable of storing of data
that were applicable of forensic applications. However, applicability of these devices in forensic
applications in full capability was not identified properly and therefore, opportunity for proper
application was not considered as well.
In order to identify how these devices could be considered for forensic applications, it is
important to identify some of its advanced features that are provided with these devices. In 2010,
apple brought ios 4, its 4th generation of mobile operating system that was by far most advanced
operating system in the market. With this ios 4, it brought some advanced features that made
people consider its applicability in forensic aspect rather than just considering it some
commercial smartphone.
In ios 4 one important feature that is of importance in this context is AirPrint. As its name
suggest, this is a feature related with printing. However, what make this feature special is that it
is capable of printing wirelessly which means that there is no need of traditional printing feature
as printing is done wirelessly which apple marketed as AirPrint. Although this was a simple
feature, but one special feature of this is lack of driver support.

3
ARTICLE REVEIW
3-result: In traditional printing facility, driver is required for printing any document. But in this
context, there were no requirement for driver for printing any document or anything that needs
printing facility. However, while this was an excellent feature as long as portability and
convenience are concerned, there were something to look for when it is analysed from forensic
point of view. When printing is done through AirPrint, some traces are left. This is an important
feature when applied in forensic analysis. As traces of printing is there, it might be considered to
identify details of document. Sometime a document might be lost and it might not be easy to
retrieve those document. Therefore, when it is possible to recover those document by analysing
traces of document, it becomes very significant from forensic point of view. Therefore, it is
important to identify whether this is a feasible option to retrieve document from its traces as it is
considered in forensic investigation and accuracy and authenticity are of prime importance in
this context. According to analysis as provided in this article, it is possible to retrieve those
traces, but for this, extensive analysis of these devices are required.
4-conclusions: This is applicable for ios devices which offers significant encryption for its
document security. However, if proper procedure is applied, it is possible to analyze these
documents even though these documents are encrypted. Therefore, these ios devices are
applicable for various forensic aspects as well
Future work and compering : Further work will be performed in the recovery process. i
ARTICLE 2
1-main area: Main area of research is that smart phones have been causing severe issues in the
data processing field. It is seen that the smart phones have been generating huge amount of data
which have been proposing the working employ encryption method. This section includes the

4
ARTICLE REVEIW
fact that encryption of data is required in the process. IMO have been similarly providing
encryption to its data during both the video calling and the voice calling process. Proper
detection of the traffic flow can be made in and hence wise classifying different events gets
easier in the process. This section also ensures the fact that better management of the protocols
that are used in IMO can be performed.
2-proposed solution: The proposed solution that are stated in the process are using the technique
of implementing encryption and hence wise this section includes the fact that there will be proper
assessment of the working process.
This section have been considering the fact that network traffic have been considered in
the working process. Usage of firewall have been considered in the section as well.
Firewall implementation processing is also stated in the process. This will be bettering
robustness of the system and hence wise the data breaching process will be reducing.
3-result: The result and analysis of the entire working process will be ensuring the fact that there
is a different file structure that is maintained by the artifacts. It is seen that there is a proper
sectioning of the working process as per the differentiation in between the platform of android
and iOS devices. The salient aspects that are considered in the process are namely having
similarity in the application in both the android and iOS platform. There is a single directory that
is to be considered in the iOS platform for the IMO app. It have been seen that iOS have been
creating 32 character alpha numeric names as per the unique identifiers. It have been observed
that the UID name of the IMO app have changed in case of each installation. Another aspect that
is found in the process is that IMO supports encrypted traffic and this is one of the major reason
of safety of the platform. This section also ensures that the data that are generated in the process
will be ensuring that there will be bettering of the extensive traffic analysis process. This traffic

5
ARTICLE REVEIW
analysis process have been including the fact that there is a proper management of the identified
IMO traffic.
4-conclusions :From the above discussion, it can be stated that the data processing have been
performed with the help of encryption in the IMO app. This ensures that the security of the data
processing is maintained in the process. This security maintaining have been a major look out in
this case.
5. future work and compering : It is expected that the future work will be based on the network
forensics of IMO. This domain is considered as a weak domain and this is the main reason that
the issue will be researched on in future. This is one of the main reasons that the functionality on
the process is maintained withy proper efficiency.ii
ARTICLE 3
1-main area: The point of focus for this journal is AirPrint. In this journal proper description of
the mode of operation have been considered. Analyzing the technical stand point is also
considered in the process. Recoverability of the AirPrintb is also discussed in the process. This
section also ensures that there is a proper sectioning of the features that enables data encryption.
This data encryption process will be benefitting the feature data encryption process. A
descriptive discussion is made regarding the topic of operations of AirPrint. The origin and
working process of Apple AIrPrint have been considered in the section and this is the main
reason this journal is considered highly regarding AirPrint data.
2-proposed solution: There are few steps that act important in the process. This section includes
the fact that the device is needed to be filled some applications. Providing multimedia content

6
ARTICLE REVEIW
have been another major aspect that is considered in the process. After this process, syncing of
the data is performed. This ensures the fact that rebooting of the device will be performed.
Rebooting from the start to clean state is also stated in the process.
Proper usage of the GoodReader application have been considered as it will be having a
better processing of the 20 documents and this ensures that a total of 109 pages will be used.
This is the main reason that the operational process will be getting benefitted in the process.
After 24 hours there will be an issue regarding the booting of the device and hence wise this will
be ensuring the fact that there is a proper removal of all Apple apps along with the multimedia
content.
Again after 24 hours the activities are deleted in order to manage the storage. After this
process the system is rebooted and hence wise ensuring that there is a better assessment of the
clean state. After this recovering process gets initiated.
3-result: It can be stated that recovering the entire data is possible. Recovering the meta data is
also possible in this section. It is seen that the despite being corrupted, data can be retrieved. The
rate of recoverability is considered to be low. This may be due to the usage of disc scheduling.
4-conclusions: From the above discussion, it can be stated that there will be a proper assessment
of the forensic traces. This is the main aspect that is to be considered. In this section. Developing
method of leverage is also considered to be important. Recovering process acts important as
well.
5. Future work and compering: Future work will be performed as per the possibility of carrying
out of the network traffic that will be ensuring that there will be a proper recovery process. iii

i Gomez-Miralles, L., & Arnedo-Moreno, J. (2013). Analysis of the Forensic Traces Left by AirPrint in
Apple iOS Devices. 2013 27Th International Conference On Advanced Information Networking And
Applications Workshops. https://doi.org/10.1109/waina.2013.40
ii Sudozai, M. A. K., Saleem, S., Buchanan, W. J., Habib, N., & Zia, H. (2018). Forensics study of IMO
call and chat app. Digital Investigation, 25, 5-23.
iii Gómez-Miralles, L., & Arnedo-Moreno, J. (2015). AirPrint Forensics: Recovering the Contents and
Metadata of Printed Documents from iOS Devices. Mobile Information Systems, 2015, 1-10.
https://doi.org/10.1155/2015/916262

Bibliography
Gomez-Miralles, L., & Arnedo-Moreno, J. (2013). Analysis of the Forensic Traces Left by AirPrint in
Apple iOS Devices. 2013 27Th International Conference On Advanced Information
Networking And Applications Workshops. https://doi.org/10.1109/waina.2013.40
Gómez-Miralles, L., & Arnedo-Moreno, J. (2015). AirPrint Forensics: Recovering the Contents and
Metadata of Printed Documents from iOS Devices. Mobile Information Systems, 2015, 1-10.
https://doi.org/10.1155/2015/916262
Sudozai, M. A. K., Saleem, S., Buchanan, W. J., Habib, N., & Zia, H. (2018). Forensics study of IMO
call and chat app. Digital Investigation, 25, 5-23.