MoLIFE Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination

Jul 16, 2026

Upload by Quinn

Mobile forensics receives less attention in digital forensic investigations because strong data-protection mechanisms on Android and iOS can prevent physical acquisition of protected directories. Attempts to bypass superuser restrictions require privilege escalation or custom ROMs, which can alter device state. Meanwhile, escalating mobile adoption and connectivity drive rising security threats. The paper introduces MoLIFE, a Mobile Live Intelligent Forensics Examination methodology grounded in NIST SP800-101, extensible with emerging technologies, validated via an Android data-acquisition case study.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages19

Reading Time48 min

Introduction

Mobile forensics context and challenges

Digital forensics needs in incident response and trials

Limitations of device access and evidence trustworthiness

MoLIFE overview and methodology basis

Integration with emerging technologies

Case study validation

MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination Silvia Lucia Sannaa,∗ , Cristina Alcarazc , Alessandro Sannaa , Giorgio Giacintoa,b and Javier Lopezc a University of Cagliari, Dept of Electrical and Electronic Engineering, Via Marengo, 2, Cagliari, 09123, Italy bInteruniversity National Consortium for Informatics, CINI, Via Ariosto, 25, Rome, 00185, Italy c University of Malaga, NICS Lab, Campus de Teatinos s/n, Malaga, 29071, Spain arXiv :2607 .07269v 1 [ cs .CR] 8 Jul 2026 ARTICLE INFO Keywords: Mobile Forensics Digital Forensics Mobile Digital Twin Cybersecurity ABSTRACT Nowadays, mobile forensics is less explored in Digital Forensics case analysis due to the increase in data protection mechanisms implemented by tech companies (i.e. Google for Android and Apple for iOS) . For example, the physical acquisition or analysis of speciﬁc directories under superuser protection would corrupt the evidence; access to such data is protected, and bypassing this protection requires either privilege escalation or custom ROM installation, leading to the modiﬁcation of the device state. At the same time, the demand for mobile technologies and their respective communication systems is increasing exponentially, exposing numerous security threats and risks. For that reason, this paper presents a Mobile Live Intelligent Forensics Examination (MoLIFE), a novel Digital Forensics (DF) methodology for data acquisition and analysis of mobile devices. The proposed methodology is based on NIST SP800-101fortheDF process. MoLIFE can be integrated with new and emerging technologies by exploiting their power (e.g. AI, blockchain, quantum computing) . MoLIFE can also be used to prevent cyber threats and incidents, as well as DF post-mortem analysis, oﬀering examples of applying the MoLIFE methodology and good practices for the future. To prove the technical feasibility of the methodology, a small case study on Android devices data acquisition via themDT will be presented. As the methodology is based on new and emerging technologies, it depends on their limitations that would be overcome in a few years. 1. Introduction Mobile Forensics is the science of retrieving data from mobile devices [5] . It includes a set of techniques to extract and analyze data stored in a mobile device when a speciﬁc crime is committed. Such analysis can be conducted only if requested and authorized by a judge. Nowadays, mobile devices are part of our everyday life, as well as tools for a wide variety of business-related tasks. In fact, they are widely employed for personal necessities or working activities (e.g. industries, critical infrastructure monitoring, healthcare data collection and monitoring, surveillance, etc.) . So far, there are two main Operating Systems (OS) for mobile devices: Android, developed by Google and installed by many vendors (e.g. Samsung, Oppo, Xiaomi), and iOS, developed by Apple and installed in iPhones 1. The main diﬀerences between such devices do not rely only on the OS used but also on the vendor [48] . In fact, diﬀerent vendors can introduce distinct protection mechanisms, proprietary Software Applications (SwA), and custom hardware platforms. Reports show that there are 7.2 billion of mobile devices with millions of people connected worldwide[33], expected to grow with an investment of USD 6.79 Billion for 2029 [22]. The number ofcyber attackson mobile devices has thus increased rapidly in recent years [4] . ∗Corresponding author [silvial.sanna@unica.it](silvial.sanna@unica.it) (S.L. Sanna); [alcaraz@uma.es](alcaraz@uma.es) (C. Alcaraz); [alessandro.sanna96@unica.it](alessandro.sanna96@unica.it) (A. Sanna); [giorgio.giacinto@unica.it](giorgio.giacinto@unica.it) (G. Giacinto); [javierlopez@uma.es](javierlopez@uma.es) (J. Lopez) ORCID(s): 1 [https://gs.statcounter.com/os-market-share/mobile/worldwide](https://gs.statcounter.com/os-market-share/mobile/worldwide) Re

FAQs

Why is mobile forensics more difficult in digital forensic case analysis?

Mobile forensics is challenged by data-protection mechanisms on Android and iOS that restrict access to protected directories and can make physical acquisition or analysis corrupt evidence.

What risks arise when trying to bypass superuser protections on mobile devices?

Bypassing restrictions typically requires privilege escalation or installing a custom ROM, which can modify the device state and affect the integrity of the evidence.

How does MoLIFE position itself in relation to existing digital-forensics processes?

MoLIFE proposes a mobile live intelligent forensics examination methodology for data acquisition and analysis, based on the NIST SP800-101 DF process and intended to integrate with emerging technologies.

Jul 16, 2026

Upload by Quinn