A forensic analysis of streaming platforms on Android OS

This work builds on existing research in streamed video reconstruction on the Android OS, which pre-viously demonstrated that caching occurs in most cases for the Chrome and Firefox Web browsers. Prior work also outlined that streaming application caching behaviour is dependent on both the imple-mentation of the service, as well as the actions taken by the user, with contrasting results between replaying videos and viewing live content. We conduct a forensic investigation for the Twitch, Facebook, Reddit, Instagram and Periscope Android applications, with a focus on the application specific folders in the/data/data directory. Applications were populated with data by creating accounts and viewing a mixture of live and replay (recorded) video streams, with a focus on attempting to recover video frag-ments or identifiers for particular streams/videos. As users may take action to hinder forensic endeav-ours, additional videos were viewed to identify baseline caching and overwriting behaviour on each application. Additionally, Android's 'Cache clear' operation was evaluated for its anti-forensic potential.While Android seems to produce different behaviour for live and recorded streams, which is consistent with prior work, our findings suggest that Android applications typically retain few, or no, video arte-facts, which contrasts with their browser based counterparts. Cache clearing also appears to be a powerful, and trivial, anti-forensics step for clearing locally cached media in each application. We suggest that, going forward, new applications should be tested on a variety of platforms, as it appears that they do not necessarily leave behind consistent forensic traces across versions.(c) 2022 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).