# Forensic Analysis of Android Cryptocurrency Wallet Applications

Chen Shi, Yong Guan

► To cite this version:

Chen Shi, Yong Guan. Forensic Analysis of Android Cryptocurrency Wallet Applications. 19th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2023, Arlington, VA, United States. pp.21-36, 10.1007/978-3-031-42991-0_2. hal-05517480

HAL Id: hal-05517480

https://inria.hal.science/hal-05517480v1

Submitted on 18 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Forensic Analysis of Android Cryptocurrency Wallet Applications

Chen Shi and Yong Guan

Iowa State University, Ames, Iowa, USA

guan@iastate.edu

**Abstract.** Crypto wallet apps that integrate with blockchains enable users to execute digital currency transactions with quick response codes. In 2021, there were more than 68 million crypto wallet app users [8]. As new crypto wallets and cryptocurrencies enter the market, the number of users will continue to increase. Mobile apps are commonly employed by users to execute cryptocurrency transactions and manage funds. As a result, sensitive information stored in mobile apps constitutes critical evidence in digital forensic investigations.

This chapter describes a forensic analysis method for Android cryptocurrency wallet apps that extracts evidence from the local filesystems and system logs. The results of forensic analyses of 253 real-world Android cryptocurrency wallet apps are interesting. A total of 135 crypto wallet apps store user account information in local filesystems that are accessible by malware. As many as 67 crypto wallet apps access and store user location information in a local database and log files, and twelve crypto wallet apps track the last used times of other applications installed on the devices. The research also reveals that, without resorting to deleted file recovery, various types of evidentiary data can be identified in local filesystems and system logs. Additionally, several types of evidence that were latent in previous studies are shown to be discoverable.

**Keywords:** Android Crypto Wallet Apps · Mobile App Forensics · Taint Analysis

## 1 Introduction

Mobile devices such as smartphones and tablets are hugely popular around the world. The global use of smartphones surpassed that of personal computers in 2013 [10]. Meanwhile, the mobile wallet industry is set to register profits of approximately $750.3 billion by 2028 [7].

Attractive features provided by crypto wallet apps on mobile devices have enabled them to dominate significant portions of cryptocurrency usage. Crypto wallet apps, which enable users to access their wallets anytime and anywhere, maintain private data and forensic artifacts that constitute critical evidence in civil and criminal cases. Analysis of cryptocurrency transactions provides insights into user activities and purchase history. Location data and the associated timestamps help construct chains of events.
Cryptocurrency wallets, especially web-based wallets and desktop wallets, have been the subject of research. Mirza et al. [20] presented approaches for extracting evidence such as private keys, IP addresses and timestamps from Web3 wallets on Android and iOS devices. However, forensic analysis approaches for crypto wallet apps on Android platforms are limited. Previous studies have not analyzed messages in Android logging systems that are written by crypto wallet apps. The studies have not focused on the key question of where evidence is stored. Additionally, since only a few crypto wallet apps – just three to five of the most popular apps – from among the more than 200 available apps have been investigated by researchers, the analysis results are not strong enough to generalize their conclusions.

This chapter describes an improved forensic analysis method for extracting artifacts generated by Android crypto wallet apps. The method, which involves live and offline analyses, was applied to 253 real-world crypto wallet apps on Android devices. The results reveal that more than 24 types of evidence are re-trievable from the internal filesystems and system logs. This work is the first to include Android log messages in forensic analyses of crypto wallet apps. Additionally, it is the first to perform large-scale forensic analyses of Android crypto wallet apps.

## 2 Background

A recent Statista survey [24] revealed that there were more than 68 million crypto wallet users in 2022. The number of crypto wallet users is expected to grow with the increase of mobile device accessibility. While more and more markets are accepting cryptocurrency payments from consumers concerned about privacy, increasing numbers of cryptocurrency transactions involve illicit addresses. As a result, law enforcement personnel need better methods for seizing cryptocurrency and conducting forensic analyses of crypto wallet apps.

A crypto wallet contains pairs of public and private cryptographic keys. A key pair is used to track ownership and to receive or spend cryptocurrency. The public key enables other parties to make payments to the address derived from the key, which serves as a traditional bank account number whereas the private key enables cryptocurrency to be spent from the address.

To initiate a cryptocurrency payment transaction to another account, a cryptocurrency holder generates a transaction message and broadcasts it to the entire cryptocurrency network. Miners then proceed to validate the transaction. If the transaction is valid, the transaction is appended to the cryptocurrency blockchain.

Most crypto wallet apps claim to leverage methods that protect user privacy. Crypto wallets may be pseudonymous, but in their user agreements, they also include “Know Your Customer” protocols through which apps collect large amounts of user data. Each crypto wallet app has its own user interface and code implementation for storing and handling user data. At this time, dozens of trojaned cryptocurrency wallet apps target Android platforms [28]. These apps,
<figure><img src="image_3.png" /><figcaption>Fig. 1. Method getLastKnownLocation.</figcaption></figure>

which are distributed by websites that mimic legitimate services, steal user secret
seed phrases by impersonating apps such as Coinbase and MetaMask.

To order to protect their private data from being leaked, some users attempt
to uninstall crypto wallet apps or reset data on their Android platforms. These
methods completely remove the files in the internal storage of the apps. Since
this topic is outside the scope of this research, analysis of the evidence generated
and deleted by a crypto wallet app itself is not discussed in this chapter.

To reiterate, mobile crypto wallet apps make it very convenient for users
to conduct financial transactions, but exactly what data is stored on mobile
devices and uploaded to servers is unknown. Indeed, forensic studies of crypto
wallet apps on Android platforms are practically nonexistent.

3 Motivating Example

Several malicious crypto wallet apps have been implemented to steal user funds. Fake wallets distributed on Chinese websites and advertised on the Telegram channel in 56 Facebook groups led to a ban on cryptocurrency exchanges and the suspension of new user registrations in Mainland China. In January 2022, Google Play Store removed 13 malicious applications that impersonated the legitimate Jaxx Liberty Wallet app [28].

In 2021, Hu et al. [16] reported that BitcoinJ [3], a widely-used Bitcoin client library, had a vulnerability that leaked Bitcoin addresses of mobile crypto wallet apps. Hu and colleagues also discovered that crypto wallet apps using BitcoinJ continuously downloaded client transactions without raising alerts or notifications.

A study of the Android library by Shi et al. [23] identified a third-party
advertisement library named **iscom.yrkfgo.assxqx4** that is used by several
crypto wallet apps. Shi and colleagues discovered that location information was
generated and accessed by the advertisement library. Figure 1 shows the code of
method **getLastKnownLocation** in the **iscom.yrkfgo.assxqx4** library. When
the GPS location of a device changes, the crypto wallet app receives the new
<figure><img src="image_4.png" /><figcaption>Fig. 2. Forensic analysis method.</figcaption></figure>

GPS location. Method getLastKnownLocation then proceeds to write the GPS location to the system log.

# 4 Methodology

Figure 2 provides an overview of the forensic analysis method for Android crypto wallet apps. The method incorporates two phases, evidence collection and evidence analysis. A significant improvement is the inclusion of logging system message collection which is not considered by other forensic analysis methods for crypto wallet apps [20]. Since the messages in the logging system are volatile data, they are collected after operating crypto wallet apps using an automated testing script. This is followed by the logical extraction of the filesystem and the examination and validation of the extracted evidence.

## 4.1 Log Message Forensic Analysis

Log messages assist app developers by providing debugging information such as the line numbers of code where errors occurred. Each log message has a system timestamp, message level, message tag, process identifier and message body.

The message tag and message body are provided by API arguments whereas timestamps and process identifiers are generated by the system. The message level, which is used to filter messages, is determined by the invoked API, which is the only way that an app can access the logging system. For example, the DE-BUG level is assigned to the message written by `Log.d(String tag, String msg)` and the INFO level is tagged to the message written by `Log.i(String msg)`.
`tag`, `String msg`). Since a log message always has a timestamp associated with it, a log message containing a network URL can be treated as a browsing history record. Log messages containing latitude and longitude data can be used to reconstruct user movements. Therefore, log messages must be parsed when performing forensic analysis on crypto wallet apps in order to understand user activity.

The Android operating system allocates four memory buffers, main, radio, events and system, to implement the logging system. Each buffer is assigned to store messages for different purposes. For example, any message logged by official APIs, such as `Log.d(String tag, String msg)`, is stored in the main buffer in the kernel-level implementation. Although certain Android operating system versions set the buffer size to 64 KB, the size may be reconfigured by users in the developer mode. When a buffer is full, the oldest message is overwritten. The Android Debug Bridge (ADB) interface is used to communicate between a host computer and mobile device to retrieve log messages. After the connection is set up, the command `#adb logcat` is issued to retrieve log messages.

In the experiment, the command `#adb logcat -b main -b radio -b events -b system -v time » /path_to_dump_file` was executed to obtain log messages. This command retrieves the log messages from all four log buffers, appends timestamps to the messages and stores them at the specified destination.

There are two advantages to considering log messages during the forensic analysis of crypto wallet apps. First, the logging system can be accessed without root permission, enabling forensic practitioners to extract log messages immediately after a device is obtained. Second, even if the device user intentionally deletes data such as previous transactions, the log messages are not affected. These benefits improve the chances of obtaining digital evidence for forensic analysis.

## 4.2 Filesystem Forensic Analysis

Filesystem forensic analysis focuses on the artifacts stored in an Android filesystem. The target of filesystem forensic analysis is to identify the locations of evidence that can help understand recent user activity. Filesystem data is obtained using logical and/or physical extraction. Logical extraction performs file copy operations recursively to collect data whereas physical extraction images every block of the filesystem. The forensic analysis method engages a logical extraction technique for evidence acquisition. This is because the recovery of deleted files on an Android platform is challenging and beyond the scope of this research. Additionally, logical extraction is faster than physical extraction, which has to image the entire storage media.

The Android filesystem is divided into internal and external storage. After an app is installed on a device, the Android operating system assigns its internal storage at `/data/data/<package name>/` where `<package name>` is the unique identifier of the Android app. For example, the package name of the Coinbase app is `com.coinbase.android`. The app is only allowed to access its own directory
in internal storage without applying for permission. Unlike internal storage, external storage designated as /sdcard/ is mounted to be publicly-available to all apps.

Since it is not known *a priori* which files contain evidence, data collection must cover internal as well as external storage. Unlike external storage that is accessed without permission, root permission is required to access files in internal storage. Therefore, before extracting evidence from internal storage, a forensic practitioner has to ensure that the device is unlocked and rooted. However, unlocking a device with factory reset protection may cause a system reset and corrupt the evidence. To address this problem, data collection must leverage SRSRoot [21] to safely root the Android device without flashing it.

Rooting an Android device provides complete access to the internal storage. Logical extraction is then performed using `#adb pull` to set up a connection that sends the extracted files from the device to the host computer. To locate file that may contain evidence, taint analysis is employed to track data flows from source methods to sink methods. When files do not store data in plaintext format, tools such as SQLite browser and hexdump may be used to parse SQLite database files and binary files, respectively.

# 5 Experimental Evaluation

This section evaluates the application of the proposed forensic analysis method on crypto wallet apps. Case studies are presented to cover the common types of evidence identified in a large-scale analysis of crypto wallet apps. The analysis results are intended to assist forensic practitioners in extracting evidence in real-world scenarios.

The experimental evaluation environment included a workstation running the Ubuntu Linux 18.04 LTS operating system. Two Android devices were employed, a Google Pixel 2 running an Android Oreo 8.1 emulator and a Google Pixel 1 running Marshmallow 6.0.

A total of 253 crypto wallet apps were obtained from 46 Android app markets. Log message forensic analysis and taint analysis were applied to the internal filesystem of each app to create forensic reports. Since some apps were large and required considerable time to be analyzed completely, an eight-hour limit was set for each app. Most of the apps were analyzed within the eight-hour limit.

## 5.1 Log Message Analysis Results

In the log analysis experiments, the latest versions of each crypto wallet app was downloaded and installed on an Android device. The logging system was reset and cleared before installation. After running the automated testing script written in Monkey [11] for eight hours, the log messages were dumped to a file.

Figure 3 shows a portion of a log message containing location information. The information includes the latitude and longitude along with an appended timestamp. The timestamped location can be used to reconstruct user activity.
<figure><img src="image_5.png" /><figcaption>Fig. 3. Location information in a log message.</figcaption></figure>

Extracting log messages is simple because root permission is not required for
access. This result demonstrates that log messages constitute useful evidence
obtained during the forensic analysis of crypto wallet apps.

8-12 10:23:12.231 21437 21437 I chromium: [INFO: CONSOLE (1)] "", source: https://www.google.com

8-12 10:23:12.231 21437 21437 I chromium [INFO: CONSOLE(1)] "", https://www.google.com/maps
@42.316997,93.152000

8-12 10:23:12.231 21437 21437 I chromium: [INFO: CONSOLE (1)] *, Waiting for response,
source: https://www.google.com/

8-12 10:23:12.231 21437 21437 I chromium: [INFO: CONSOLE (1)] ** Battery Power Supply logging
Daemon start, source: https://www.google.com/

8-12 10:23:12.231 21437 21437 I chromium: [INFO: CONSOLE(1)] "", Could not open 'system/etc/user'
source: https://www.google.com

8-12 10:23:12.231 21437 21437 I chromium: [INFO: CONSOLE (1)] **, ERROR: could not read
system/etc/user.conf
source: https://www.google.com/

8-12 10:23:12.231 21437 21437 I chromium: [INFO:CONSOLE (1)] "" source: https://www.google.com

<caption>Fig. 4. Log messages from the Bread Wallet app.</caption>

Other types of evidence stored in log messages include visited URLs, IP addresses and timestamps. Research was conducted to examine why visited URLs are written to the logging system. Tracing back from the message tag chromium in Figure 4 revealed that the log messages came from the Android WebKit API. Specifically, the WebChromeClient in the WebKit API writes a message to the Android logging system when the callback method onConsoleMessage(...) is invoked by a console message received from the visited website server. If the webpage has JavaScript code such as console.log(String) where the argument is the message body, a console message is sent. When the browser app on the client device receives the console message, the message body and source website of the message are written to the logging system of the device. This mechanism provides valuable evidence about user browsing history.

5.2 Filesystem Analysis Results

Forensic artifacts are also stored in the filesystem. The large-scale evaluation
revealed that more than half of the real-world crypto wallet apps generate and
access evidentiary data, and save the data in internal storage.
<table><caption>Table 1. Forensic analysis report for the com/crypto.manywallet app.</caption><thead><tr><th>App Package</th><th>Downloads</th><th>Evidence Type</th><th>Evidence Log</th><th>File Paths</th></tr></thead><tbody><tr><td>com/crypto.manywallet</td><td>50K</td><td>Timestamp</td><td>*</td><td>/data/user/0/com/crypto.manywallet/shared_pref<sub>s</sub><br>/data/user/0/com/crypto.manywallet/databases/Journal-centeringStoreDatabase.db</td></tr><tr><td colspan="5">Visited URL *</td></tr><tr><td>Cookie</td><td></td><td></td><td>/data/app_webview/Cookies.db</td><td></td></tr><tr><td>Location</td><td></td><td></td><td>/data/user/0/com/crypto.manywallet/databases/Journal-centeringStoreDatabase.db</td><td></td></tr></tbody></table>

<footnote>* Information exists in the log.</footnote>
<table><tr><td>Table: loc</td><td>Filter in any column</td></tr></table>

<table><caption>Fig. 5. Location information in the com/crypto multiwallet app database.</caption><thead><tr><th rowspan="2"></th><th>#</th><th>TIME</th><th>LATITUDE</th><th>LONGITUDE</th><th>ACCURATE</th></tr><tr><th>Filter</th><th>Filter</th><th>Filter</th><th>Filter</th><th>Filter</th></tr></thead><tbody><tr><td>1</td><td>1</td><td>1666744372</td><td>42.04717</td><td>-93.631913</td><td>3737316582</td></tr><tr><td>2</td><td>2</td><td>1666744412</td><td>42.03078</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>3</td><td>3</td><td>1666744456</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>4</td><td>4</td><td>1666744474</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>5</td><td>5</td><td>1666744558</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>6</td><td>6</td><td>1666744725</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>7</td><td>7</td><td>1666745092</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>8</td><td>8</td><td>1666745172</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>9</td><td>9</td><td>1666745265</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>10</td><td>10</td><td>1666745471</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>11</td><td>11</td><td>1666745613</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>12</td><td>12</td><td>1666745624</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>13</td><td>13</td><td>1666745843</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr><tr><td>14</td><td>14</td><td>1666745843</td><td>42.04717</td><td>-93.64614</td><td>3737316582</td></tr></tbody></table>

A case study involving the com/crypto multiwallet app was used to gain insights into the general files that contain evidentiary data. Table 1 shows the forensic analysis report for the app. Forensic artifacts are stored in three files in the filesystem. Note that the file paths are under the app's internal storage directory: data/data/com/crypto multiwallet/.

Figure 5 shows the locations and timestamps parsed from the SQLite database file StoreDatabase.db located at /databases/Journal/. The database file records user location information every 60 minutes.

Figure 6 shows that the cookie database located in the WebView directory /app_webview/ contains user browsing history. WebView is a significant component of the Android WebKit API. A cookie is a simple key-value data pair received from a website and stored by the web browser. Each cookie record is associated with a website URL. Therefore, the browsing history can be obtained by associating the URL with its last accessed timestamp. Since the content is designed by the website developer, it might contain other private data that enables the website to provide user-oriented services. For example, as shown in Figure 6, google.com saves the device's geo-data and country code in rows 12 and 36. By parsing geo-location information from the cookies, forensic practitioners can also track users.
<table><caption>Fig. 6. Visited URLs in `app_webview/Cookies.db` of `com/crypto multiwallet` app.</caption><thead><tr><th>ID</th><th>Cookie / Data Key name</th><th>URL</th><th>Description</th><th>Value</th></tr></thead><tbody><tr><td>2</td><td>256c0fe2-d881-11e9-8a34-2a2ae2dbce4</td><td>https://privacy.google.com/take-control.html</td><td>es of a user</td><td>ss</td></tr><tr><td>3</td><td>256c12b2-d881-11e9-8a34-2a2ae2dbce4</td><td>https://www.google.com/</td><td>es of a user</td><td>ss</td></tr><tr><td>4</td><td>256c12b2-d881-11e9-8a34-2a2ae2dbce5</td><td>https://www cookiebot.com/en/cookie-declaration/</td><td>s domains / websites</td><td>1213</td></tr><tr><td>5</td><td>24daac45-6c94-4c77-a972-66a9e5248413</td><td>https://www cookiebot.com/en/cookie-declaration/</td><td>cookie banner</td><td>A</td></tr><tr><td>6</td><td>87a6c581-24b5-4d1b-bf99-c0e493364625</td><td>https://www.google.com/</td><td>opt-in/out choices.</td><td>1</td></tr><tr><td>7</td><td>b735da18-68f1-4dd4-95d4-ee1e29f1d37f</td><td>https://www.google.com/</td><td>countryCode</td><td></td></tr><tr><td>8</td><td>551c9acd-8d52-4808-bf2c-88acc840c091</td><td>https://www.google.com/</td><td>cookie consent system</td><td>f</td></tr><tr><td>9</td><td>6ca095be-4711-47f0-9e83-eecc86ff12c9</td><td>https://www.google.com/</td><td>geoData</td><td></td></tr></tbody></table>

<figure><img src="image_6.png" /><figcaption>Fig. 7. App ID data in `device_info.db` of `com/crypto multiwallet` app.</figcaption></figure>

Figure 7 shows that the `device_info.db` database located at `/data/data/LocalStorage/` contains app ID data and timestamps. The app ID is the package name (unique Android app identifier) and the timestamp records the time that the app was last accessed. This information provides insights about the user's mobile device activity. Three apps stored data in the `device_info.db` database: TikTok (com.zhiliaoapp.musically), Snapchat (com.snapchat.android) and Outlook (com.microsoft.office.outlook).

## 5.3 Large-Scale Forensic Analysis Results

The large-scale forensic analysis focused on 253 real-world crypto wallet apps. The apps were collected from 46 app markets in the U.S. and abroad. The logging system was reset and the internal storage wiped before installing each app. Following app installation, the app was exercised for up to eight hours using the Monkey automated testing script. Next, the app was closed and forensic analyses of the log messages and extracted files were performed. Finally, the forensic artifacts pertaining to the app were published in a report.

The experiments revealed that 212 of the 253 crypto wallet apps stored evidentiary data in the logging system and/or the local filesystem. Sixty-seven of the 212 apps had user location information in their internal storage. One hundred and thirty-five apps periodically recorded device timestamps and stored them in the logging system or filesystem. Fifty-four apps recorded user SMS text messages and 124 apps recorded visited URLs and stored them in log messages or in the database. Especially interesting was that 37 apps stored other kinds of evidentiary data such as call logs and account information.
<table><caption>**Table 2.** Forensic analysis results for the 253 Android crypto wallet apps.</caption><thead><tr><th rowspan="2">Evidence Type</th><th colspan="2">Apps Evidence File Paths</th></tr><tr><th>Static</th><th>Dynamic</th></tr></thead><tbody><tr><td>Location</td><td>67 42</td><td>2</td></tr><tr><td>Time</td><td>135 97</td><td>12</td></tr><tr><td>Text Input</td><td>54 16</td><td>1</td></tr><tr><td>Visited URL</td><td>124 132</td><td>52</td></tr><tr><td>Other Evidentiary Data</td><td>122 40</td><td>7</td></tr></tbody></table>

Table 2 summarizes the forensic analysis results for each type of evidentiary data. Among the 17 types of extracted evidentiary data, time data is the most common and 49.6% of crypto wallet apps store this data in their local filesystems. File paths are characterized as dynamic if they include the patterns <timestamp>, <UUID>, <android version> or <intent>; otherwise, they are characterized as static. The results demonstrate that Android crypto wallet apps use static file paths more often (75.5%) than dynamic file paths (24.5%).

<table><caption>**Table 3.** Credit card information stored by the com.breadwallet app.</caption><tr><td>&lt;string name = "6SHYZH": billingAddress: billingCity&gt;</td></tr><tr><td>&lt;string name = "6SHYZH": billingAddress: billingState&gt;</td></tr><tr><td>&lt;string name = "6SHYZH": billingAddress: billingCountry&gt;</td></tr><tr><td>&lt;string name = "6SHYZH": billingAddress: billingLine1&gt;</td></tr><tr><td>&lt;string name = "6SHYZH": billingAddress: billingLine2&gt;</td></tr><tr><td>&lt;string name = "6SHYZH": billingAddress: billingZipCode&gt;</td></tr><tr><td>...</td></tr><tr><td>...</td></tr><tr><td>...</td></tr><tr><td>&lt;string name = "08APZS": creditCard: shortDescription&gt;</td></tr><tr><td>&lt;string name = "08APZS": creditCard: last4&gt;</td></tr><tr><td>&lt;string name = "08APZS": creditCard: expirationDate&gt;</td></tr><tr><td>&lt;string name = "08APZS": creditCard: CVC&gt;</td></tr></table>

The analysis also revealed that the com.breadwallet app stores credit card information in an XML document. The information includes the full billing address, credit card number, card verification number, issuing bank and expiration date; however, the cardholder's name was not recorded. Table 3 summarizes the credit card information stored by the com.breadwallet app.

The analysis also revealed that a local database file potentially stores credit card information. However, manual verification found that the database con-
tained no records even when credit cards were added to the app for testing. It
is possible that credit card data is kept in the cloud and only saved to the local
database under conditions that were not met during the testing. More research
is needed to determine the triggers that store credit card information in the local
database.

It is challenging to evaluate the forensic analysis results for crypto wallet
apps without the ground truth. As a result, best-effort manual verification was
conducted. In the manual verification, 20 apps were randomly selected from the
dataset. The apps were installed in turn on a real device and were exercised by
Monkey, which generated pseudo-random streams of user events, such as clicks,
touches and many system-level events. All the apps were tested for up to eight
hours and all the files generated by the apps were examined manually. A total
of 821 files created by the apps were discovered and forensic analysis revealed
that 37 of them contained evidentiary data.

In the manual verification, a forensic analysis result was designated as a false positive if the file did not contain the type of evidentiary data reported. Taking Table 1 as an example, if the manual examination of file shared_pref s located at data/user/0/com/crypto.multipurse/ did not contain timestamp evidence, the file was marked as a false positive. Similarly, if unreported evidentiary data was found in a file, then the file was marked as a false negative. The manual verification results revealed that the forensic analysis method yielded an average precision of 93% and average recall of 91% over all the types of evidentiary data.

Overall, the large-scale evaluation results demonstrate the effectiveness of the
forensic analysis method on crypto wallet apps. Log messages and app filesystems
are significant evidence containers and digital forensic practitioners can apply
the forensic analysis method to find the evidence.

6 Related Work

This section discusses related work on forensic analysis of logging systems and
taint analysis.

## 6.1 Logging System Analysis

While several research efforts have focused on the forensic analysis of Android
apps, they largely ignore logging system analysis. Satrya et al. [22] have con-
ducted live and offline forensic analyses of three popular social messenger apps,
but they were unable to identify evidentiary data during live analysis compared
with offline analysis. Baggili et al. [2] describe a forensic method for Android
smartwatches that collects log messages of system events to extract evidence.
However, unlike the automated method described in this chapter, they manually
parsed and analyzed log messages.

Recent studies [14, 15, 17] mention the importance of considering Android
logging systems in mobile device forensics by treating logging as an evidentiary
data sink API. However, these studies did not perform logging system analyses
or develop any analysis tools. A notable exception is the work by Cheng et al. [6], which developed LogExtractor, a tool that integrates fine-grained taint analysis with automaton-based string analysis to analyze complicated string-expression constructions such as `StringBuffer` and `Arrays.toString()` in Android log messages.

Two other approaches, OmegaLog [13] and UIScope [27], attempt to identify the root causes of Android events by analyzing and correlating log messages. UIScope discovers the root causes by monitoring and correlating user interaction events with system events. OmegaLog analyzes log message patterns offline by symbolically executing C/C++ binary programs and then adopts an online approach to identify the root causes from log message patterns.

## 6.2 Taint Analysis

Program analysis is applied heavily in forensic analyses of Android applications. Taint analysis is used to retrieve data flows between source APIs and sink APIs. If the logging system APIs are included in the sink list, taint analysis can determine whether a tainted variable is eventually written to a log message. Previous Android taint analysis efforts that cover information flows to logging systems include EviHunter [5], CHEX [19], FlowDroid [1], AmanDroid [26], IccTA [18] and DroidSafe [12]. These approaches provide coarse-grained answers on whether certain kinds of forensic artifacts are written to logging systems.

The EviHunter [5] static analysis tool leverages Soot [25] and FlowDroid [1] to construct call graphs and entry points and identify the types of sensitive data and file paths to which data is written. FlowDroid [1] is the first flow-sensitive taint analysis approach that considers the Android application life-cycle and user interface widgets. CHEX [19], which is built on top of Wala [9], first parses app code and constructs app-splits. Next, it creates a data flow summary for each app-split utilizing the Wala data flow engine to detect component hijacking on Android platforms. DroidSafe [12] models an Android framework and adopts a flow-insensitive points-to-analysis algorithm to handle all possible run-time event orderings.

## 7 Discussion

Bitcoin and other cryptocurrencies offer anonymizing features that are heavily used in illicit activities. The anonymity of cryptocurrency accounts has made them attractive to criminals on the dark web, the portion of the Internet accessible through special software that makes forensic analyses very challenging. Tracing illegal transactions, especially those associated with ransomware payments, requires anonymity breaches. The use of multiple wallets and Bitcoin further obfuscates the identification process. A Bitcoin mixer is a service that combines Bitcoin from different sources and separates them into multiple client wallets in exchange for a mixing fee. The proposed forensic analysis method
for Android cryptocurrency wallet apps has the ability to detect such mixing services.

One limitation of the proposed forensic analysis method is the best-effort manual verification. A total of 253 real-world Android crypto wallet apps were used in the evaluation, but due to the effort involved, only 20 apps could be feasibly used to verify the results with ground truth. Also, only plaintext results could be verified. For example, when GPS coordinates are encrypted, hashed or encoded before being written to the logging system, their presence in log entries could not be determined and they were designated as false positives. Additionally, the manual verification may have under-approximated the false negative rate due to the best-effort approach employed. But of course, it was infeasible to achieve 100% code coverage of 253 Android apps.

## 8 Conclusions

This chapter has presented the results of a large-scale forensic investigation of evidence generated by 253 Android cryptocurrency wallet apps. The method involves application and framework analyses that examine evidentiary data located in app logging systems and filesystems. Location information, timestamps and other types of forensic artifacts are extracted from the cryptocurrency wallet apps. The manual verification of forensic analysis method yields an average precision of 93% and average recall of 91% over all the types of evidentiary data considered. The forensic analysis method is expected to be a valuable asset to digital forensic practitioners because cryptocurrency wallet apps are heavily used in illegal activities.

**Acknowledgment** This research was partially supported by the National Institute of Standards and Technology (NIST) CSAFE under Cooperative Agreement no. 70NANB20H019, by the National Science Foundation under Grant nos. CNS 1619201, CNS 1730275, DEB 1924178 and ECCS 2030249, and by the Boeing Company.

## References

1. S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. Le Traon, D. Octeau and P. McDaniel, FlowDroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps, *ACM SIGPLAN Notices*, vol. 49(6), pp. 259–269, 2014.

2. I. Baggili, J. Oduro, K. Anthony, F. Breitinger and G. McGee, Watch what you wear: Preliminary forensic analysis of smart watches, *Proceedings of the Tenth International Conference on Availability, Reliability and Security*, pp. 303–311, 2015.

3. **bitcoinj**, A library for working with Bitcoin, GitHub (github.com/bitcoinj/bitcoinj), 2023.
4. S. Calzavara, I. Grishchenko and M. Maffei, *HornDroid: Practical and sound static analysis of Android applications by SMT solving*, *Proceedings of the IEEE European Symposium on Security and Privacy*, pp. 47–62, 2016.

5. C. Cheng, C. Shi, N. Gong and Y. Guan, *EviHunter: Identifying digital evidence in the permanent storage of Android devices via static analysis*, *Proceedings of the ACM SIGSAC Conference on Computer and Communications Security*, pp. 1338–1350, 2018.

6. C. Cheng, C. Shi, N. Gong and Y. Guan, *LogExtractor: Extracting digital evidence from Android log messages via string and taint analysis*, *Forensic Science International: Digital Investigation*, vol. 37, article no. 301193, 2021.

7. Cision, Mobile wallet market share is projected to reach USD 750.3 billion by 2028: Zion Market Research, Chicago, Illinois (www.prnewswire.com/news-releases/mobile-wallet-market-share-is-projected-to-reach-usd-750-3-billion-by-2028-zion-market-research-301477413.html), February 8, 2022.

8. FinancesOnline, Number of blockchain wallet users 2022/2023: Breakdowns, timelines and predictions, Boston, Massachusetts (financesonline.com/number-of-blockchain-wallet-users/#:~:text=As%20of%20February%202021%2C%20there a%20%24928.50%20billion%20market%20cap), 2021.

9. S. Fink, J. Dolby and F. Tip, *Wala – Static Analysis Capabilities for Java Bytecode and Related Languages*, IBM Research, Yorktown Heights, New York (*researcher.watson.ibm.com/researcher/view_page.php?id=7238*), 2012.

10. Gartner, Gartner Annual Worldwide PC, Mobile Device Market Share Report, 2013, Stamford, Connecticut, 2014.

11. Google Developers, UI/Application Exerciser Monkey, Mountain View, California (developer.android.com/studio/test/other-testing-tools/monkey), 2022.

12. M. Gordon, D. Kim, J. Perkins, L. Gilham, N. Nguyen and M. Rinard, *Information flow analysis of Android applications in DroidSafe*, *Proceedings of the Twenty-Second Annual Network and Distributed System Security Symposium*, 2015.

13. W. Hassanand, M. Noureddine, P. Datta and A. Bates, *OmegaLog: High-fidelity attack investigation via transparent multi-layer log analysis*, *Proceedings of the Twenty-Seventh Annual Network and Distributed System Security Symposium*, 2020.

14. N. Htun and M. Thwin, *Proposed workable process flow with analysis framework for Android forensics in cyber-crime investigations*, *International Journal of Engineering and Science*, vol. 6(1), pp. 82–92, 2017.

15. N. Htun, M. Thwin and C. San, *Evidence data collection with ANDROSICS tool for Android forensics*, *Proceedings of the Tenth International Conference on Information Technology and Electrical Engineering*, pp. 353–358, 2018.

16. Y. Hu, S. Wang, G. Tu, L. Xiao, T. Xie, X. Lei and C. Li, *Security threats from Bitcoin wallet smartphone applications: Vulnerabilities, attacks and countermeasures*, *Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy*, pp. 89–100, 2021.

17. P. Khandelwal, D. Sahu and D. Tomar, *Scrutinizing evidence in Android phones*, *International Journal of Computer Science and Information Technology*, vol. 5(2), pp. 2528–2533, 2014.

18. L. Li, A. Bartel, T. Bissyande, J. Klein, Y. Le Traon, S. Arzt, S. Rasthofer, E. Bodden, D. Octeau and P. McDaniel, *IccTA: Detecting inter-component privacy leaks in Android apps*, *Proceedings of the Thirty-Seventh IEEE/ACM International Conference on Software Engineering*, pp. 280–291, 2015.
19. L. Lu, Z. Li, Z. Wu, W. Lee and G. Jiang, CHEX: Statically vetting Android apps for component hijacking vulnerabilities, *Proceedings of the ACM Conference on Computer and Communications Security*, pp. 229–240, 2012.

20. M. Mirza, A. Ozer and U. Karabiyik, Mobile cyber forensic investigations of Web3 wallets on Android and iOS, *Applied Sciences*, vol. 12(21), article no. 11180, 2022.

21. OfflineModAPK, SRSRoot Apk latest 2022 for Android SRSRoot (offlinemodapk.com/srsroot-apk), March 27, 2022.

22. G. Satrya, P. Daely and S. Shin, Android forensics analysis: Private chat on social messenger, *Proceedings of the Eighth International Conference on Ubiquitous and Future Networks*, pp. 430–435, 2016.

23. C. Shi, C. Cheng and Y. Guan, LibDroid: Summarizing information flow of Android native libraries via static analysis, *Forensic Science International: Digital Investigation*, vol. 42(S), article no. 301405, 2022.

24. Statista, Number of Bitcoin block explorer Blockchain.com wallet users worldwide from November 2011 to November 17, 2022, Hamburg, Germany (www.statista.com/statistics/647374/worldwide-blockchain-wallet-users), March 8, 2023.

25. R. Vallee-Rai, P. Co, E. Gagnon, L. Hendren, P. Lam and V. Sundaresan, Soot – A Java bytecode optimization framework, *Proceedings of the Conference of the Centre for Advanced Studies on Collaborative Research*, 1999.

26. F. Wei, S. Roy, X. Ou and Robby, Amdroid: A precise and general inter-component data flow analysis framework for security vetting of Android apps, *ACM Transactions on Privacy and Security*, vol. 21(3), article no. 14, 2018.

27. R. Yang, S. Ma, H. Xu, X. Zhang and Y. Chen,UIScope: Accurate, instrumentation-free and visible attack investigation for GUI applications, *Proceedings of the Twenty-Seventh Annual Network and Distributed System Security Symposium*, 2020.

28. M. Young, 13 apps removed after researchers uncover Trojan crypto wallet scheme, *Cointelegraph*, New York (cointelegraph.com/news/13-apps-removed-after-researchers-uncover-trojan-crypto-wallet-scheme), March 30, 2022.