Hex Symbols Algorithm for Anti-Forensic Artifacts on Android Devices

Mobile phones technology has become one of the most common and important technologies that started as a communication tool and then evolved into key reservoirs of personal information and smart applications. With this increased level of complications, increased dangers and increased levels of countermeasures and opposing countermeasures have emerged, such as Mobile Forensics and anti-forensics. One of these anti-forensics tools is steganography, which introduced higher levels of complexity and security against hackers’ attacks but simultaneously create obstacles to forensic investigations. A new anti-forensics approach for embedding data in the steganography field is proposed in this paper. It is based on hiding secret data in hex symbols carrier files rather than the usually used file multimedia carrier including videos, image and sound files. Furthermore, this approach utilizes hexadecimal codes to embed the secret data on the contrary to the conventional steganography approaches which apply changes to binary codes. Accordingly, the resulting data in the carrier files will be unfathomable without the use of special keys yielding a high level of attacking and deciphering difficulty. Besides, embedding the secret data in the form of hex symbols, the agreed upon procedure between communicating parties follows a random embedding manner formulated using WinHex software. Files can be exchanged amongst android devices and/or computers. Experiments were conducted for applying the proposed algorithm on rooted android devices, which also are connected to computers. The proposed methods showed advantages over the currently existing steganography approaches, in terms of character frequency, capacity, security, and robustness.

@article{Asbeh2016,
  title     = {Hex Symbols Algorithm for Anti-Forensic Artifacts on Android Devices},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {7},
  number    = {4},
  year      = {2016},
  publisher = {The Science and Information Organization},
  author    = {Somyia M. Abu Asbeh and Sarah M. Hammoudeh and Hamza A. Al-Sewadi and Arab M. Hammoudeh},
  doi       = {10.14569/IJACSA.2016.070427},
  url       = {https://doi.org/10.14569/IJACSA.2016.070427}
}