Pith. sign in

REVIEW 1 major objections 8 minor 59 references

MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination

T0 review · 1 major / 8 minor · reviewed 2026-07-09 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Rooted virtual twin matches real phone for forensic data

desk verdict Genuinely interesting mobile forensics concept, but the synchronization mechanism in the case study doesn't match the methodology's claims. read the letter →

arxiv 2607.07269 v1 pith:7VIKAUDJ submitted 2026-07-08 cs.CR

Silvia Lucia Sanna , Cristina Alcaraz , Alessandro Sanna , Giorgio Giacinto , Javier Lopez This is my paper · ORCID
classification cs.CR
keywords methodologyforensicsmobilemolifeanalysisdatatechnologiesacquisition
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes that the central tension in mobile forensics — needing super-user access for complete data extraction versus the legal duty to preserve device integrity — can be resolved by creating a rooted virtual replica of the device that stays synchronized with the physical phone. This replica, called a mobile Digital Twin (mDT), runs as an emulator with administrative privileges. Rather than rooting the real device (which modifies its state and can render evidence inadmissible), the examiner performs all privileged acquisition on the twin. The paper's central empirical claim is that forensic data extracted from the twin matches the real device at 95–100% content similarity across network, memory, logical, and physical acquisition methods, even though cryptographic hashes never align due to emulator architecture differences. The methodology wraps this concept into a three-stage pipeline — preventive screening of apps before installation, real-time monitoring during execution, and post-mortem reconstruction of incidents — designed primarily for industrial and critical-infrastructure settings but adaptable to cooperative private investigations.

What carries the argument

The mobile Digital Twin (mDT): a rooted emulator that receives real-time data from a physical mobile device over WiFi debugging or cloud-based app synchronization, replicating the device's state while granting super-user privileges that the real device cannot safely provide. The mDT is embedded in a three-stage forensic pipeline (preventive, live, post-mortem) aligned with NIST SP800-101, and is designed to integrate AI-based anomaly detection, explainable AI for decision transparency, and LLM-assisted fuzzing for incident reconstruction.

What would settle it

If a court rejects Ratcliff/Obershelp similarity as insufficient proof of data integrity — insisting on hash-level identity between the acquired image and the original device — then the mDT's acquisitions would fail standard admissibility tests and the methodology's legal utility would collapse.

Watch

Extended reading notes

Core claim

The forensic acquisition of a synchronized, rooted mobile Digital Twin yields content equivalent to acquiring a real rooted Android device (95–100% similarity via the Ratcliff/Obershelp algorithm), enabling administrator-level data access without modifying the physical evidence.

Load-bearing premise

The paper assumes that high content similarity (95–100% by a character-matching algorithm) between an emulated device and a physical device is a forensically valid substitute for the cryptographic hash equality that digital forensics standards traditionally require for evidence integrity.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 8 minor

Summary. The paper proposes MoLIFE, a mobile live forensics methodology built around the concept of a mobile Digital Twin (mDT) — a rooted, emulated replica of a physical device that is synchronized with the real device to enable privileged forensic acquisition without altering the original evidence. The methodology is structured in three stages (preventive, live, post-mortem) aligned with NIST SP800-101, and is designed to integrate AI (including xAI and LLMs), blockchain, and edge/cloud computing. A case study on Android demonstrates that data acquired from the mDT (network, memory, logical, physical) yields 95–100% Ratcliff/Obershelp similarity to a real rooted device, and that certain messaging-app artifacts (including one-shot images) can be recovered from the mDT's RAM.

Significance. The paper addresses a genuine and well-motivated problem: the tension between full forensic access (requiring root) and evidence preservation on modern mobile devices. The mDT concept is a creative framing, and the experimental demonstration that app-level databases (e.g., Telegram cache4.db) produce identical SHA-1 hashes across a real rooted device and a synchronized mDT (Figure 6) is a concrete, falsifiable result. The integration of xAI for forensic explainability and the three-stage methodology are thoughtful design contributions. However, the central equivalence claim is supported by a narrow empirical base and rests on a synchronization mechanism whose implementation details are insufficient to fully validate the strongest claims.

major comments (1)
  1. §4.1.1 and §8 (Synchronization mechanism): The methodology defines the mDT as requiring real-time, device-level state replication ('receives data from the real device in real-time (complete synchronization)'). However, the case study in §8 implements synchronization via app-level cloud login (same WhatsApp/Telegram/Messenger account on both devices). Cloud app sync replicates only data the app backend stores; it does not synchronize RAM content, system-level files, caches, or real-time runtime events. The paper briefly mentions Frida-based interception in §7 ('Data has been sent and intercepted with Frida') but provides no details on what is intercepted, how it maps to mDT state, or how it achieves RAM-level synchronization. The authors must clarify which synchronization mechanism was actually used in the experiments and whether the equivalence results reflect true device-level DT sync,
minor comments (8)
  1. §4.1.1: The distinction between 'emulator' and 'mDT' is discussed conceptually but the practical implementation boundary is unclear. A concrete statement of what was actually implemented vs. proposed would help readers.
  2. §5, Table 2: The legend symbols (✓, −, ×, ◦) are defined, but the rationale for why certain technologies 'dissatisfy by design (not needed)' vs. 'require proper setup' for specific CIA properties should be briefly explained.
  3. §4.2, Algorithm 1: The algorithm is presented as pseudocode but reads more as a step list. Adding input/output specifications and decision logic consistent with Algorithms 2 and 3 would improve consistency.
  4. §6.1: The application scenarios section mentions monitoring victims or targets but does not discuss the significant legal and ethical implications of real-time surveillance. A brief discussion or cross-reference to §9's GDPR mention would be appropriate.
  5. §9: The paper mentions that Signal cannot be monitored due to local-only databases. This limitation should be more prominently stated, as it affects the generality of the approach for apps with no cloud sync.
  6. Figure 3: The x-axis labels (e0–e6 with UI interactions) are compact and somewhat hard to parse. Expanding the caption or adding a small legend table would improve readability.
  7. §8: The paper states 'We used the real personal data of this article's first author.' While privacy is respected, a note on ethical approval or IRB review (if applicable) would strengthen the manuscript.
  8. References: Several references appear to be from 2024–2025 and some URLs are incomplete. Ensure all references are finalized and DOIs are cited where available.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; self-citations are contextual, not load-bearing for the central equivalence claim

full rationale

The paper's central claim — that mDT forensic acquisition produces the same content as a real rooted device — is tested against an external benchmark (the real device itself), not derived from a self-citation chain or fitted parameter. The derivation chain is: (1) define mDT as a synchronized replica (Section 4.1.1), (2) acquire forensic data from both mDT and real device under identical conditions (Section 7), (3) compare using Ratcliff/Obershelp similarity (Section 7, Eq. 1). No step reduces to its own input by construction. The self-citations to Alcaraz and Lopez [6,7] concern digital twin security threats and standardization, providing background context rather than serving as the evidentiary basis for the equivalence claim. The substitution of Ratcliff/Obershelp for hash-based verification is a methodological choice (acknowledging hash mismatches due to emulator internals) — this raises validity concerns about forensic admissibility, but it is not circular: the similarity metric is computed independently on both data sources, not fitted to produce a desired result. The AI components (preventive, live, post-mortem stages) are described as future integrations and are unimplemented, so there is no fitted model whose predictions could be circular. The score of 2 reflects the presence of non-load-bearing self-citations that are normal for a methodology paper building on prior DT security work by the same group.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities
free parameters (2)
  • Similarity threshold for forensic equivalence = 95%
    The paper treats Ratcliff/Obershelp similarity above ~95% as evidence of content equivalence, but this threshold is not derived from forensic standards or validated against court admissibility criteria. It is chosen post hoc based on observed results.
  • AI model architecture and training data = unspecified
    The paper proposes semi-supervised deep learning models for anomaly detection but provides no architecture, training dataset, hyperparameters, or evaluation metrics. These are free parameters in the methodology that would need to be specified for any implementation.
assumptions (4)
  • domain assumption An emulated Android device with the same OS version, architecture, and synchronized app data produces forensically equivalent content to a real device.
    Section 4.1.1 and Section 7. The paper's central claim depends on this, but it is only partially validated by the case study and contradicted by hash mismatches and vendor-specific app differences.
  • ad hoc to paper Ratcliff/Obershelp similarity is a sufficient metric for forensic content equivalence when cryptographic hashes do not match.
    Section 7. The paper substitutes hash-based integrity verification with sequence similarity, but does not cite forensic standards or legal precedent supporting this substitution.
  • domain assumption Real-time synchronization between a physical device and an emulator is achievable via WiFi debugging or cloud-backed app synchronization.
    Section 4.1.1. The paper acknowledges this is 'not easy to implement' and describes challenges with Frida interception and repacking, but the methodology assumes it is feasible.
  • domain assumption NIST SP800-101 forensic principles (collection, examination, analysis, reporting) can be satisfied by performing acquisition on a digital twin rather than the physical device.
    Table 2 and Section 4. The paper maps each MoLIFE stage to NIST phases, but whether courts would accept mDT-derived evidence as satisfying NIST standards is unaddressed.
invented entities (1)
  • mobile Digital Twin (mDT) independent evidence
    purpose: A synchronized, rooted emulated replica of a physical mobile device used for privileged forensic analysis without modifying the real device.
    The case study in Sections 7-8 provides empirical evidence that the mDT produces similar forensic output to a real rooted device. However, the evidence is limited to Android, a few apps, and similarity metrics rather than hash equivalence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination." pith.science (2026). https://pith.science/paper/7VIKAUDJ

@misc{pith2026260707269,
  author       = {Pith},
  title        = {Pith review of: MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7VIKAUDJ}},
  note         = {Machine review of arXiv:2607.07269}
}
read the original abstract

Nowadays, mobile forensics is less explored in Digital Forensics case analysis due to the increase in data protection mechanisms implemented by tech companies (i.e., Google for Android and Apple for iOS). For example, the physical acquisition or analysis of specific directories under super-user protection would corrupt the evidence; access to such data is protected, and bypassing this protection requires either privilege escalation or custom ROM installation, leading to the modification of the device state. At the same time, the demand for mobile technologies and their respective communication systems is increasing exponentially, exposing numerous security threats and risks. For that reason, this paper presents a Mobile Live Intelligent Forensics Examination (MoLIFE), a novel Digital Forensics (DF) methodology for data acquisition and analysis of mobile devices. The proposed methodology is based on NIST SP800-101 for the DF process. MoLIFE can be integrated with new and emerging technologies by exploiting their power (e.g., AI, blockchain, quantum computing). MoLIFE can also be used to prevent cyber threats and incidents, as well as DF post-mortem analysis, offering examples of applying the MoLIFE methodology and good practices for the future. To prove the technical feasibility of the methodology, a small case study on Android devices data acquisition via the mDT will be presented. As the methodology is based on new and emerging technologies, it depends on their limitations that would be overcome in a few years.

Figures

Figures reproduced from arXiv: 2607.07269 by the authors.

Figure 1
Figure 1. MoLIFE flow diagram including all three mDT stages. Given a mobile SwA, first check if it is a known popular threat (preventive analysis) and, in case, report it. If the SwA is secure, it monitors its execution (real-time monitoring) and, once it detects the threat, reports the incident and finds the causes (post-mortem analysis) in industries, companies, and critical infrastructures to mon￾itor and prevent cyber in… view at source ↗
Figure 2
Figure 2. The methodology operates in three coordinated stages: Preventive, Live, and Post-Mortem. The Preventive stage analyzes installation requests using a clean backup; if safe, it installs the app. If an anomaly is detected, control moves to the Live stage, which locks the real device and collects forensic and xAI data. The Post-Mortem stage analyzes this data, reconstructs events, and, if no threat is confirmed, instruc… view at source ↗
Figure 3
Figure 3. Acquisition percentages over time (t) and user interaction (UI). The graph shows, for the eight different forensics acquisition methodologies, the similarities between the acquired analyzed data between the mDT and the real device under the same running condition (same architecture, OS, running application and version, running time, and user inputs). Similarity has been computed with the Ratcliff/Obershelp algorithm… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Protected directories on non-rooted device (above/up) vs. rooted Digital Twin (below/down) [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]
Figure 5
Figure 5. Figure 5: Image retrieved with carving methodology from the memory dump of the Telegram application in the mDT but the image visualized in the real device. The context of the image can be clearly and unequivocally seen cannot be displayed. Pictures with one-shot visualization ca…
Figure 6
Figure 6. Figure 6: Telegram cache4.db equality across devices: identical SHA-1s (a) and matching hexdump tails (b) for the real rooted device (Samsung A33), its synchronized mDT (emulator– 5556), and a rooted mDT with synchronized Telegram access (emulator–5554). mDT is rooted, we can di…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 59 canonical work pages

  1. [1]

    What is a digital twin anyway? deriving the defini- tion for the built environment from over 15,000 scientific publications

    Abdelrahman, M., Macatulad, E., Lei, B., Quintana, M., Miller, C., Biljecki, F., 2025. What is a digital twin anyway? deriving the defini- tion for the built environment from over 15,000 scientific publications. Building and Environment doi: 10.1016/j.buildenv.2025.112748

    work page doi:10.1016/j.buildenv.2025.112748 2025

  2. [2]

    Mobile foren- sics for android devices: A systematic literature review (20152025)

    Aguirregomezcorta, U., García del Pozo, J.A., 2025. Mobile foren- sics for android devices: A systematic literature review (20152025). Digital Forensics Research Review

    work page 2025

  3. [3]

    Clone detection to prevent software piracy in android play store

    Ahammed, M., 2024. Clone detection to prevent software piracy in android play store. GSC Advanced Research and Reviews 21, 108131. doi:10.30574/gscarr.2024.21.3.0487

    work page doi:10.30574/gscarr.2024.21.3.0487 2024

  4. [4]

    Classification of cyber security threats on mobile devices and appli- cations

    Al Hwaitat, A., Almaiah, M., Al-Zahrani, A., Almomani, O., 2021. Classification of cyber security threats on mobile devices and appli- cations

    work page 2021

  5. [5]

    Mobile forensics: A review, in: 2020 In- ternational Conference on Computing and Information Technology (ICCIT-1441), pp

    Alatawi, H., Alenazi, K., Alshehri, S., Alshamakhi, S., Mustafa, M., Aljaedi, A., 2020. Mobile forensics: A review, in: 2020 In- ternational Conference on Computing and Information Technology (ICCIT-1441), pp. 1–6. doi: 10.1109/ICCIT-144147971.2020.9213739

    work page doi:10.1109/iccit-144147971.2020.9213739 2020

  6. [6]

    Digital Twin Security: A Perspective on Efforts From Standardization Bodies

    Alcaraz, C., Lopez, J., . Digital Twin Security: A Perspective on Efforts From Standardization Bodies. IEEE Security and Privacy doi:10.1109/MSEC.2024.3504193

    work page doi:10.1109/msec.2024.3504193 2024

  7. [7]

    Digital Twin: A Comprehensive Survey of Security Threats

    Alcaraz, C., Lopez, J., 2022. Digital Twin: A Comprehensive Survey of Security Threats. IEEE Communications Surveys & Tutorials doi:10.1109/COMST.2022.3171465

    work page doi:10.1109/comst.2022.3171465 2022

  8. [8]

    Blockchain-assisted access for federated smart grid domains: Coupling and features

    Alcaraz, C., Rubio, J.E., Lopez, J., 2020. Blockchain-assisted access for federated smart grid domains: Coupling and features. Jour- nal of Parallel and Distributed Computing 144, 124–135. URL: /wp-content/papers/Alcaraz2020a.pdf

    work page 2020

Show all 59 references
  1. [9]

    Impact of android phone rooting on user data integrity in mobile forensics, in: 2019 2nd International Conference on Computer Applications & Information Security (IC- CAIS), pp

    Almehmadi, T., Batarfi, O., 2019. Impact of android phone rooting on user data integrity in mobile forensics, in: 2019 2nd International Conference on Computer Applications & Information Security (IC- CAIS), pp. 1–6. doi: 10.1109/CAIS.2019.8769520

    2019 doi

  2. [10]

    A crit- ical analysis on android vulnerabilities, malware, anti-malware and anti-malware bypassing

    Alrammal, M., Naveed, M., Sallam, S., Tsaramirsis, G., 2022. A crit- ical analysis on android vulnerabilities, malware, anti-malware and anti-malware bypassing. Journal of Internet Technology 23, 1651–

    2022

  3. [11]

    publisher Copyright: © 2022 Taiwan Academic Network Management Committee

    doi: 10.53106/160792642022122307019. publisher Copyright: © 2022 Taiwan Academic Network Management Committee. All rights reserved

    2022 doi

  4. [12]

    Guidelines on mobile device forensics

    Ayers, R., Brothers, S., Jansen, W., 2014. Guidelines on mobile device forensics. doi: https://doi.org/10.6028/NIST.SP.800-101r1

    2014 doi

  5. [13]

    Life: Logical ios forensics ex- aminer, in: Proceedings of the Digital Forensics Research Workshop (DFRWS USA), Elsevier

    Bader, S., Baggili, I., Mislan, R., 2017. Life: Logical ios forensics ex- aminer, in: Proceedings of the Digital Forensics Research Workshop (DFRWS USA), Elsevier. pp. 33–45

    2017

  6. [14]

    Evading Android Anti-malware by Hiding Malicious Application Inside Images

    Badhani, S., Muttoo, S.K., 2018. Evading Android Anti-malware by Hiding Malicious Application Inside Images. International Journal of System Assurance Engineering and Management 9, 482–493. doi: 10. 1007/s13198-017-0692-7

    2018

  7. [15]

    Bays, R., Karabiyik, U., 2019. Forensic analysis of third-party location applications in android and ios, in: Proceedings of the 12th International Conference on Security of Information and Networks (SIN 2019), pp. 1–8. doi: 10.1145/3357613.3357624

    2019 doi

  8. [16]

    Vedrando: A novel way to reveal stealthy attack steps on android through memory forensics

    Bellizzi, J., Losiouk, E., Conti, M., Colombo, C., Vella, M., 2023. Vedrando: A novel way to reveal stealthy attack steps on android through memory forensics. Journal of Cybersecurity and Privacy 3, 364–395. URL: https://www.mdpi.com/2624-800X/3/3/19, doi: 10. 3390/jcp3030019

    2023

  9. [17]

    Real-time triggering of android memory dumps for stealthy attack investigation, in: Asplund, M., Nadjm-Tehrani, S

    Bellizzi, J., Vella, M., Colombo, C., Hernandez-Castro, J., 2021a. Real-time triggering of android memory dumps for stealthy attack investigation, in: Asplund, M., Nadjm-Tehrani, S. (Eds.), Secure IT Systems, Springer International Publishing, Cham. pp. 20–36

  10. [18]

    Responding to living-off-the-land tactics using just-in-time memory forensics (jit-mf) for android

    Bellizzi, J., Vella, M., Colombo, C., Hernandez-Castro, J., 2021b. Responding to living-off-the-land tactics using just-in-time memory forensics (jit-mf) for android. URL: https://arxiv.org/abs/2105. 05510, arXiv:2105.05510

    arXiv

  11. [19]

    Responding to targeted stealthy attacks on android using timely- captured memory dumps

    Bellizzi, J., Vella, M., Colombo, C., Hernandez-Castro, J., 2022. Responding to targeted stealthy attacks on android using timely- captured memory dumps. IEEE Access 10, 35172–35218. doi: 10. 1109/ACCESS.2022.3160531. S.L. Sanna et al.: Preprint submitted to Elsevier Page 17 o...

    2022

  12. [20]

    Digital twin-the simulation aspect, in: Mechatronic Futures: Challenges and Solutions for Mechatronic Systems and Their Designers

    Boschert, S., Rosen, R., 2016. Digital twin-the simulation aspect, in: Mechatronic Futures: Challenges and Solutions for Mechatronic Systems and Their Designers. doi: 10.1007/978-3-319-32156-1\_5

    2016 doi

  13. [21]

    Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

    Chen, X., Li, C., Wang, D., Wen, S., Zhang, J., Nepal, S., Xiang, Y., Ren, K., 2020. Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection. IEEE Transactions on Information Forensics and Security 15, 987 1001. doi: 10.1109/TIFS. 2019.2932228

    2020 doi

  14. [22]

    Mobile foren- sics: Repeatable and non-repeatable technical assessments

    Cuomo, R., DAgostino, D., Ianulardo, M., 2022. Mobile foren- sics: Repeatable and non-repeatable technical assessments. Sensors doi:10.3390/s22187096

    2022 doi

  15. [23]

    Global mobile computing devices market industry trends and forecast to 2029

    Data Bridge Market Research, 2022. Global mobile computing devices market industry trends and forecast to 2029. URL: https://www.databridgemarketresearch.com/reports/ global-mobile-computing-devices-market

    2022

  16. [24]

    Unlocking digital evidence: Recent challenges and strategies in mobile device forensic analysis

    Fakiha, B., 2024. Unlocking digital evidence: Recent challenges and strategies in mobile device forensic analysis. Journal of Internet Services and Information Security 14, 68–84. doi: 10.58346/JISIS. 2024.I2.005

    2024 doi

  17. [25]

    Logical acquisition method based on data migration for android mobile devices

    Feng, P., Li, Q., Zhang, P., Chen, Z., 2018. Logical acquisition method based on data migration for android mobile devices. Digital Investigation 26, 55–62. doi: https://doi.org/10.1016/j.diin.2018. 05.003

    2018 doi

  18. [26]

    Triggerscope: Towards detecting logic bombs in android applications, in: 2016 IEEE Symposium on Security and Privacy (SP), pp

    Fratantonio, Y., Bianchi, A., Robertson, W., Kirda, E., Kruegel, C., Vigna, G., 2016. Triggerscope: Towards detecting logic bombs in android applications, in: 2016 IEEE Symposium on Security and Privacy (SP), pp. 377–396. doi: 10.1109/SP.2016.30

    2016 doi

  19. [27]

    A new model for forensic data extraction from encrypted mobile devices

    Fukami, A., Stoykova, R., Geradts, Z., 2021. A new model for forensic data extraction from encrypted mobile devices. Forensic Science International: Digital Investigation 38, 301169. doi: https: //doi.org/10.1016/j.fsidi.2021.301169

    2021 doi

  20. [28]

    Digital twin: Enabling technologies, challenges and open research

    Fuller, A., Fan, Z., Day, C., Barlow, C., 2020. Digital twin: Enabling technologies, challenges and open research. IEEE Access doi: 10. 1109/ACCESS.2020.2998358

    2020

  21. [29]

    Systematic evaluation of forensic data acquisition using smartphone local backup

    Geus, D., Ottmann, S., Freiling, F.C., 2024. Systematic evaluation of forensic data acquisition using smartphone local backup. arXiv preprint arXiv:2404.12808

    2024 arXiv

  22. [30]

    Digital twin: Mitigating unpre- dictable, undesirable emergent behavior in complex systems, in: Transdisciplinary Perspectives on Complex Systems: New Findings and Approaches

    Grieves, M., Vickers, J., 2016a. Digital twin: Mitigating unpre- dictable, undesirable emergent behavior in complex systems, in: Transdisciplinary Perspectives on Complex Systems: New Findings and Approaches

  23. [31]

    Origins of the digital twin concept

    Grieves, M., Vickers, J., 2016b. Origins of the digital twin concept. Florida Institute of Technology 8, 3–20

  24. [32]

    Wltdroid: Repackaging de- tection approach for android applications

    Guo, J., Liu, D., Zhao, R., Li, Z., 2020. Wltdroid: Repackaging de- tection approach for android applications. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12432 LNCS, 579 591. doi: 10. 1007...

    2020

  25. [33]

    An abstract model for digital forensic analysis tools - a foundation for systematic error mitigation analysis

    Hargreaves, C., Nelson, A., Casey, E., 2024. An abstract model for digital forensic analysis tools - a foundation for systematic error mitigation analysis. Forensic Science Inter- national: Digital Investigation URL: https://www.sciencedirect. com/science/article/pii/S26662817...

    2024

  26. [34]

    How many people own smartphones? (2024- 2029)

    Howarth, J., 2025. How many people own smartphones? (2024- 2029). Exploding Topics URL: https://explodingtopics.com/blog/ smartphone-stats

    2025

  27. [35]

    A first look at on-device models in ios apps

    Hu, H., Huang, Y., Chen, Q., Zhuo, T.Y., Chen, C., 2023. A first look at on-device models in ios apps. Association for Computing Machinery doi:10.1145/3617177

    2023 doi

  28. [36]

    A survey on mobile malware detection methods using machine learning, in: IEEE

    Kambar, M.E.Z.N., Esmaeilzadeh, A., Kim, Y., Taghva, K., 2022. A survey on mobile malware detection methods using machine learning, in: IEEE. doi: 10.1109/CCWC54503.2022.9720753

    2022 doi

  29. [37]

    Anti-forensics and the digital investigator, in: ADFC

    Kessler, G.C., 2007. Anti-forensics and the digital investigator, in: ADFC

    2007

  30. [38]

    Quantum computing and its implications for cybersecurity: A comprehensive review of emerging threats and defenses

    Khan, S., Krishnamoorthy, P., Goswami, M., Rakhimjonovna, F.M., Mohammed, S.A., Menaga, D., 2024. Quantum computing and its implications for cybersecurity: A comprehensive review of emerging threats and defenses. Nanotechnology Perceptions URL: https:// nano-ntp.com/index.php/...

    2024

  31. [39]

    ARIs- toteles Dissecting Apples Baseband Interface

    Kröll, T., Kleber, S., Kargl, F., Hollick, M., Classen, J., 2021. ARIs- toteles Dissecting Apples Baseband Interface. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 12972 LNCS. doi:10.1007/978...

    2021 doi

  32. [40]

    A comparative study of mobile forensic tools for android devices, in: Proceedings of the International Conference on Recent Advances in Information Science and Data, Atlantis Press

    Kumar, P., Sharma, M., Gupta, R., 2025. A comparative study of mobile forensic tools for android devices, in: Proceedings of the International Conference on Recent Advances in Information Science and Data, Atlantis Press. pp. 114–121. doi: 10.2991/raisd-25.2025.15

    2025 doi

  33. [41]

    Privacy and security challenges of the digital twin: systematic literature review

    Kutelega, M., Mekovec, R., Shareef, A., 2024. Privacy and security challenges of the digital twin: systematic literature review. JUCS - Journal of Universal Computer Science 30, 1782–1806. doi: 10.3897/ jucs.114607

    2024

  34. [42]

    Repacking ios applications

    LabsWithSecure, . Repacking ios applications. URL: https://labs.withsecure.com/publications/ repacking-and-resigning-ios-applications

  35. [43]

    Review of digital twin about concepts, technologies, and industrial applications

    Liu, M., Fang, S., Dong, H., Xu, C., 2021. Review of digital twin about concepts, technologies, and industrial applications. Journal of Manufacturing Systems 58. doi: 10.1016/j.jmsy.2020.06.017

    2021 doi

  36. [44]

    Comparative analysis of android mobile forensics tools, in: 2020 IEEE Conference on Computer Applications(ICCA)

    Lwin, H.H., Aung, W.P., Lin, K.K., 2020. Comparative analysis of android mobile forensics tools, in: 2020 IEEE Conference on Computer Applications(ICCA). doi: 10.1109/ICCA49400.2020.9022838

    2020 doi

  37. [45]

    Industry 5.0: A survey on enabling technologies and potential applications

    Maddikunta, P., Pham, Q.V ., B, P., Deepa, N., Dev, K., Gadekallu, T., Ruby, R., Liyanage, M., 2022. Industry 5.0: A survey on enabling technologies and potential applications. Journal of Industrial Infor- mation Integration 26. doi: 10.1016/j.jii.2021.100257

    2022 doi

  38. [46]

    Anti-forensic challenges in digital forensics investigations: An overview of techniques and tools, in: ICSPIS

    Mohammad, I.A., Nasar, A.O., Alkhawaldeh, M., Qazi, E.U.H., Zia, T., 2024. Anti-forensic challenges in digital forensics investigations: An overview of techniques and tools, in: ICSPIS. doi: 10.1109/ ICSPIS63676.2024.10812632

    2024

  39. [47]

    Multi-platform process flow models and algorithms for ex- traction and documentation of digital forensic evidence from mobile devices

    Ocen, G., Bongomin, G.O.C., Barasa, S., Makau, J., Semwogerere, D., 2024. Multi-platform process flow models and algorithms for ex- traction and documentation of digital forensic evidence from mobile devices. Forensic Science International: Digital Investigation

    2024

  40. [48]

    The Routledge International Handbook of Forensic Intelligence and Crim- inology

    Rossy, Q., Décary-Hétu, D., Delémont, O., Mulone, M., 2018. The Routledge International Handbook of Forensic Intelligence and Crim- inology. Routledge

    2018

  41. [49]

    Android v/s ios the unceasing battle

    Sahani, A., 2017. Android v/s ios the unceasing battle. Interna- tional Journal of Computer Applications 180, 23–26. doi: 10.5120/ ijca2017915990

    2017

  42. [50]

    On the (in)effectiveness of static logic bomb detection for android apps

    Samhi, J., Bartel, A., 2022. On the (in)effectiveness of static logic bomb detection for android apps. IEEE Transactions on Depend- able and Secure Computing 19, 3822–3836. doi: 10.1109/TDSC.2021. 3108057

    2022 doi

  43. [51]

    Sanna, S.L., Panzino, A., La Cava, S.M., Concas, S., Regano, L., Maiorca, D., Marcialis, G.L., Giacinto, G., 2025. Pixel perfect or per- fectly fake? exploring the robustness of digital forensic tools against facial deepfakes and morphed images, in: Proceedings of the 33rd Eu-...

    2025

  44. [52]

    Exploring the robustness of ai-driven tools in digital forensics: A preliminary study

    Sanna, S.L., Regano, L., Maiorca, D., Giacinto, G., 2024. Exploring the robustness of ai-driven tools in digital forensics: A preliminary study. URL: https://arxiv.org/abs/2412.01363, arXiv:2412.01363

    2024 arXiv

  45. [53]

    Enhancing android malware detection explainability through function call graph apis

    Soi, D., Sanna, A., Maiorca, D., Giacinto, G., 2024. Enhancing android malware detection explainability through function call graph apis. Journal of Information Security and Applications 80, 103691

    2024

  46. [54]

    On the feasibility of android stegomalware: A detection study

    Soi, D., Sanna, S.L., Liguori, A., Zuppelli, M., Regano, L., Maiorca, D., Caviglione, L., Manco, G., Giacinto, G., 2025. On the feasibility of android stegomalware: A detection study. itasec ceur

    2025

  47. [55]

    Android rooting: Meth- ods, detection, and evasion, in: ACM, Association for Computing Machinery

    Sun, S.T., Cuadros, A., Beznosov, K., 2015. Android rooting: Meth- ods, detection, and evasion, in: ACM, Association for Computing Machinery. doi: 10.1145/2808117.2808126

    2015 doi

  48. [56]

    Live memory forensics of mobile phones, in: Digital Investigation, Elsevier

    Thing, V .L.L., Ng, K., Chang, E.C., 2010. Live memory forensics of mobile phones, in: Digital Investigation, Elsevier. pp. S74–S82. doi:10.1016/j.diin.2010.05.009. S.L. Sanna et al.: Preprint submitted to Elsevier Page 18 of 19 MoLIFE

    2010 doi

  49. [57]

    Byod must be met with a wider appreciation of the cyber-security threat

    Timms, K., 2017. Byod must be met with a wider appreciation of the cyber-security threat. Computer Fraud and Security doi: https: //doi.org/10.1016/S1361-3723(17)30058-1

    2017 doi

  50. [58]

    IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware, in: IS

    Wong, M., Lie, D., 2016. IntelliDroid: A Targeted Input Generator for the Dynamic Analysis of Android Malware, in: IS. doi: 10.14722/ ndss.2016.23118

    2016

  51. [59]

    Fuzz4ALL: Universal Fuzzing with Large Language Models

    Xia, C., Paltenghi, M., Tian, J., Pradel, M., Zhang, L., 2024. Fuzz4ALL: Universal Fuzzing with Large Language Models. doi: 10. 1145/3597503.3639121. Biographies Silvia Lucia Sanna is a Ph.D. student (since November 2022) in the National Ph.D. in AI for Se- curity and Cybersec...

    2024

Pith tools

Reviewed July 9, 2026 · model on record in the stance chip above.