[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83213-en":3,"doc-seo-83213-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83213,962075114765,"Quinn","https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd",8,"Research & Report","MoLIFE Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination","Mobile forensics receives less attention in digital forensic investigations because strong data-protection mechanisms on Android and iOS can prevent physical acquisition of protected directories. Attempts to bypass superuser restrictions require privilege escalation or custom ROMs, which can alter device state. Meanwhile, escalating mobile adoption and connectivity drive rising security threats. The paper introduces MoLIFE, a Mobile Live Intelligent Forensics Examination methodology grounded in NIST SP800-101, extensible with emerging technologies, validated via an Android data-acquisition case study.","MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination  \nSilvia Lucia Sannaa,∗ , Cristina Alcarazc , Alessandro Sannaa , Giorgio Giacintoa,b and Javier Lopezc  \na University of Cagliari, Dept of Electrical and Electronic Engineering, Via Marengo, 2, Cagliari, 09123, Italy bInteruniversity National Consortium for Informatics, CINI, Via Ariosto, 25, Rome, 00185, Italy  \nc University of Malaga, NICS Lab, Campus de Teatinos s/n, Malaga, 29071, Spain  \narXiv :2607 .07269v 1 [ cs .CR] 8 Jul 2026  \nARTICLE INFO  \nKeywords:  \nMobile Forensics Digital Forensics Mobile Digital Twin Cybersecurity  \nABSTRACT  \nNowadays, mobile forensics is less explored in Digital Forensics case analysis due to the increase in data protection mechanisms implemented by tech companies (i.e. Google for Android and Apple for iOS) . For example, the physical acquisition or analysis of specific directories under superuser protection would corrupt the evidence; access to such data is protected, and bypassing this protection requires either privilege escalation or custom ROM installation, leading to the modification of the device state. At the same time, the demand for mobile technologies and their respective communication systems is increasing exponentially, exposing numerous security threats and risks. For that reason, this paper presents a Mobile Live Intelligent Forensics Examination (MoLIFE), a novel Digital Forensics (DF) methodology for data acquisition and analysis of mobile devices. The proposed methodology is based on NIST SP800-101fortheDF process. MoLIFE can be integrated with new and emerging technologies by exploiting their power (e.g. AI, blockchain, quantum computing) . MoLIFE can also be used to prevent cyber threats and incidents, as well as DF post-mortem analysis, offering examples of applying the MoLIFE methodology and good practices for the future. To prove the technical feasibility of the methodology, a small case study on Android devices data acquisition via themDT will be presented. As the methodology is based on new and emerging technologies, it depends on their limitations that would be overcome in a few years.  \n1. Introduction  \nMobile Forensics is the science of retrieving data from mobile devices [5] . It includes a set of techniques to extract and analyze data stored in a mobile device when a specific crime is committed. Such analysis can be conducted only if requested and authorized by a judge. Nowadays, mobile devices are part of our everyday life, as well as tools for a wide variety of business-related tasks. In fact, they are widely employed for personal necessities or working activities (e.g. industries, critical infrastructure monitoring, healthcare data collection and monitoring, surveillance, etc.) . So far, there are two main Operating Systems (OS) for mobile devices: Android, developed by Google and installed by many vendors (e.g. Samsung, Oppo, Xiaomi), and iOS, developed by Apple and installed in iPhones 1. The main differences between such devices do not rely only on the OS used but also on the vendor [48] . In fact, different vendors can introduce distinct protection mechanisms, proprietary Software Applications (SwA), and custom hardware platforms. Reports show that there are 7.2 billion of mobile devices with millions of people connected worldwide[33], expected to grow with an investment of USD 6.79 Billion for 2029 [22]. The number ofcyber attackson mobile devices has thus increased rapidly in recent years [4] .  \n∗Corresponding author  \n [silvial.sanna@unica.it](silvial.sanna@unica.it) (S.L. Sanna); [alcaraz@uma.es](alcaraz@uma.es) (C. Alcaraz); [alessandro.sanna96@unica.it](alessandro.sanna96@unica.it) (A. Sanna); [giorgio.giacinto@unica.it](giorgio.giacinto@unica.it) (G. Giacinto); [javierlopez@uma.es](javierlopez@uma.es) (J. Lopez)  \nORCID(s):  \n1 [https://gs.statcounter.com/os-market-share/mobile/worldwide](https://gs.statcounter.com/os-market-share/mobile/worldwide)  \nRe","cbCaitocHTWDLVWZ","https://ap.wps.com/l/cbCaitocHTWDLVWZ","pdf",3186436,2,1,19,"English","en",105,"# Introduction\n## Mobile forensics context and challenges\n## Digital forensics needs in incident response and trials\n## Limitations of device access and evidence trustworthiness\n# MoLIFE overview and methodology basis\n## Integration with emerging technologies\n## Case study validation","[{\"question\":\"Why is mobile forensics more difficult in digital forensic case analysis?\",\"answer\":\"Mobile forensics is challenged by data-protection mechanisms on Android and iOS that restrict access to protected directories and can make physical acquisition or analysis corrupt evidence.\"},{\"question\":\"What risks arise when trying to bypass superuser protections on mobile devices?\",\"answer\":\"Bypassing restrictions typically requires privilege escalation or installing a custom ROM, which can modify the device state and affect the integrity of the evidence.\"},{\"question\":\"How does MoLIFE position itself in relation to existing digital-forensics processes?\",\"answer\":\"MoLIFE proposes a mobile live intelligent forensics examination methodology for data acquisition and analysis, based on the NIST SP800-101 DF process and intended to integrate with emerging technologies.\"}]",1784185993,48,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"molife-methodology-technologies-and-challenges-for-mobile-live-intelligent-forensics-examination","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,47,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":20},"https://docshare.wps.com/document/","Document",{"item":48,"name":12,"@type":43,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/molife-methodology-technologies-and-challenges-for-mobile-live-intelligent-forensics-examination/83213/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-20","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is mobile forensics more difficult in digital forensic case analysis?","Question",{"text":75,"@type":76},"Mobile forensics is challenged by data-protection mechanisms on Android and iOS that restrict access to protected directories and can make physical acquisition or analysis corrupt evidence.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What risks arise when trying to bypass superuser protections on mobile devices?",{"text":80,"@type":76},"Bypassing restrictions typically requires privilege escalation or installing a custom ROM, which can modify the device state and affect the integrity of the evidence.",{"name":82,"@type":73,"acceptedAnswer":83},"How does MoLIFE position itself in relation to existing digital-forensics processes?",{"text":84,"@type":76},"MoLIFE proposes a mobile live intelligent forensics examination methodology for data acquisition and analysis, based on the NIST SP800-101 DF process and intended to integrate with emerging technologies.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},"General","general"]