  Crimes, both physical and cyber, increasingly involve smartphones due to
their ubiquity. Therefore, digital evidence on smartphones plays an
increasingly important role in crime investigations. Digital evidence could
reside in the memory and permanent storage of a smartphone. While we have
witnessed significant progresses on memory forensics recently, identifying
evidence in the permanent storage is still an underdeveloped research area.
Most existing studies on permanent-storage forensics rely on manual analysis or
keyword-based scanning of the permanent storage. Manual analysis is costly,
while keyword matching often misses the evidentiary data that do not have
interesting keywords.
  In this work, we develop a tool called EviHunter to automatically identify
evidentiary data in the permanent storage of an Android device. There could be
thousands of files on the permanent storage of a smartphone. A basic question a
forensic investigator often faces is which files could store evidentiary data.
EviHunter aims to answer this question. Our intuition is that the evidentiary
data were produced by apps; and an app's code has rich information about the
types of data the app may write to a permanent storage and the files the data
are written to. Therefore, EviHunter first pre-computes an App Evidence
Database (AED) via static analysis of a large number of apps. The AED includes
the types of evidentiary data and files that store them for each app. Then,
EviHunter matches the files on a smartphone's permanent storage against the AED
to identify the files that could store evidentiary data.
  We evaluate EviHunter on benchmark apps and 8,690 real-world apps. Our
results show that EviHunter can precisely identify both the types of
evidentiary data and the files that store them.
